Is there any way to get the process/command name of the flow traffics via netoberv ebpf agent?

[WENPIN1]

Hi all,

Is there any way to get the process/command name of the flow traffics via netoberv ebpf agent?
e.g.
bpf_get_current_comm(&data.comm, sizeof(data.comm));

very appreciated!

-WENPIN

[jotak]

Hi @WENPIN1 ,
Unfortunately bpf_get_current_comm isn't available on all types of attached programs, and not on the TC programs the netobserv uses. We could use new hooks to get the information and do some correlation, but it's not straightforward and not without performance impact.
That said, there is bpf_get_current_pid_tgid that, if I'm correct, have been added to TC programs recently (6.10 kernels). This would be an interesting addition.

[msherif1234]

@WENPIN1 is ur case using ebpf agent as standalone prog or you are using k8s solution ?