netdev - Re: tcp_diag for all network namespaces?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1373213.1733863522@famine>
Date: Tue, 10 Dec 2024 12:45:22 -0800
From: Jay Vosburgh <jv@...sburgh.net>
To: Cong Wang <xiyou.wangcong@...il.com>
cc: dave seddon <dave.seddon.ca@...il.com>, netdev@...r.kernel.org
Subject: Re: tcp_diag for all network namespaces?

Cong Wang <xiyou.wangcong@...il.com> wrote:

>On Mon, Dec 09, 2024 at 11:24:18AM -0800, dave seddon wrote:
>> G'day,
>> 
>> Short
>> Is there a way to extract tcp_diag socket data for all sockets from
>> all network name spaces please?
>> 
>> Background
>> I've been using tcp_diag to dump out TCP socket performance every
>> minute and then stream the data via Kafka and then into a Clickhouse
>> database.  This is awesome for socket performance monitoring.
>> 
>> Kubernetes
>> I'd like to adapt this solution to <somehow> allow monitoring of
>> kubernetes clusters, so that it would be possible to monitor the
>> socket performance of all pods.  Ideally, a single process could open
>> a netlink socket into each network namespace, but currently that isn't
>> possible.
>> 
>> Would it be crazy to add a new feature to the kernel to allow dumping
>> all sockets from all name spaces?
>
>You are already able to do so in user-space, something like:
>
>for ns in $(ip netns list | cut -d' ' -f1); do
>    ip netns exec $ns ss -tapn
>done
>
>(If you use API, you can find equivalent API's)

	FWIW, if any namespaces weren't created through /sbin/ip, then
something like the following works as well:

#!/bin/bash

nspidlist=`lsns -t net -o pid -n`

for p in ${nspidlist}; do
	lsns -p ${p} -t net
	nsenter -n -t ${p} ss -tapn
done

	-J

---
	-Jay Vosburgh, jv@...sburgh.net