Re: [tcpdump-workers] Link-layer header type for unix domain sockets (UDS)

2019-03-24 Thread František Kučera
Dne 23. 03. 19 v 21:04 Guy Harris napsal(a): On Mar 23, 2019, at 12:50 PM, František Kučera wrote: There is no MAC or IP address, but there are other useful metadata: socket path (might be also abstract), direction, UID, GID, PID... Stream, datagram, or sequenced-packet sockets? In my appl

Re: [tcpdump-workers] Link-layer header type for unix domain sockets (UDS)

2019-03-24 Thread Guy Harris
On Mar 24, 2019, at 3:14 AM, František Kučera wrote: > Dne 23. 03. 19 v 21:04 Guy Harris napsal(a): >> On Mar 23, 2019, at 12:50 PM, František Kučera >> wrote: >> >>> There is no MAC or IP address, but there are other useful metadata: socket >>> path (might be also abstract), direction, UID,

Re: [tcpdump-workers] Link-layer header type for unix domain sockets (UDS)

2019-03-24 Thread František Kučera
Dne 24. 03. 19 v 19:18 Guy Harris napsal(a): So perhaps we need separate link-layer header types for "arbitrary segment of a stream" (which would require TCP-like processing) and "datagram"? UDS are bit weird from the layer point of view, because they are like TCP or UDP but on the other hand

Re: [tcpdump-workers] Link-layer header type for unix domain sockets (UDS)

2019-03-24 Thread František Kučera
Dne 24. 03. 19 v 13:59 Michael Richardson napsal(a): I don't see a problem with making up the metadata. Yes, it works. I attached a screenshot of my current proof-of-concept. I can filter by the socket path, see the metadata in a structured way and it also decodes the data format (DER in this

Re: [tcpdump-workers] Link-layer header type for unix domain sockets (UDS)

2019-03-24 Thread František Kučera
Dne 24. 03. 19 v 22:50 František Kučera napsal(a): Dne 24. 03. 19 v 13:59 Michael Richardson napsal(a): I don't see a problem with making up the metadata. Yes, it works. I attached a screenshot of my current proof-of-concept. I can filter by the socket path, see the metadata in a structured w