Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
make "linux kernel" connections configurable
Sometimes when a new connection is about to be established, we don't get the PID of the process using the eBPF proc monitor method. But in some rare situations, the kernel still holds information about the connection (sock_diag struct basically). We assume that these connections are initiated from kernel space. Per some debugging, this doesn't seem to be always the root cause, so these connections will only be shown if InterceptUnknown config field is set to true.
- Loading branch information