feat(netprobe): IPv6 UDP + ICMPv6 flow attribution (#3425) #3528

Merged

mfreeman451 merged 2 commits from feat/netprobe-udp-icmp into staging 2026-06-04 20:14:14 +00:00

Conversation 0 Commits 2 Files changed 5 +259 -31

mfreeman451 commented 2026-06-04 19:49:51 +00:00

Owner

Copy link

What

Extends netprobe flow attribution (built on the #3425 native add-on framework) to cover UDP-over-IPv6 and ICMPv6, on top of the base UDP/ICMP-v4 5-tuple fix.

netprobe (eBPF + userspace)

• UDP/IPv6: udpv6_sendmsg/udpv6_recvmsg kprobes — IPv6 UDP never traverses the v4 udp_* path, so it was missed entirely. Both share a new emit_udp helper (socket_tuple reads the family → one helper serves v4 + v6).
• ICMPv6: ping_v6_sendmsg/rawv6_sendmsg kprobes; emit_icmp_send derives IPPROTO_ICMPV6 (58) from the socket address family.
• All v6 probes attach best-effort (attach_optional_probe, renamed from attach_icmp_probe) — a missing optional hook (IPv6 disabled, renamed symbol) must not take down core TCP/UDP attribution.
• Userspace accepts proto 58 in flow_key_from_record; transport_protocol maps 58 → "icmpv6".

core

• The pushed FlowAttributionEvent transport string "icmpv6" was being dropped by flow_attribution.ex (it only knew icmp6/ipv6-icmp), so ICMPv6 rows never reached flow_process_attributions. Both transport_to_proto mappings (flow_attribution + attributed_flow_joiner) now accept all three variants icmp6/icmpv6/ipv6-icmp → 58.

Validation

On a kernel 6.8 box (attribution-only mode), flow_process_attributions now carries:

• TCP v4 + v6 (proto 6)
• UDP v4 + v6 (proto 17) — v6 via udpv6_sendmsg
• ICMP v4 (proto 1)
• ICMPv6 kprobes fire and reach FLOW_EVENTS (flow_to_pid family=10 proto=58); end-to-end proto-58 rows land once this core proto-mapping fix is deployed.

🤖 Generated with Claude Code

## What Extends netprobe flow attribution (built on the #3425 native add-on framework) to cover **UDP-over-IPv6** and **ICMPv6**, on top of the base UDP/ICMP-v4 5-tuple fix. ### netprobe (eBPF + userspace) - **UDP/IPv6**: `udpv6_sendmsg`/`udpv6_recvmsg` kprobes — IPv6 UDP never traverses the v4 `udp_*` path, so it was missed entirely. Both share a new `emit_udp` helper (`socket_tuple` reads the family → one helper serves v4 + v6). - **ICMPv6**: `ping_v6_sendmsg`/`rawv6_sendmsg` kprobes; `emit_icmp_send` derives `IPPROTO_ICMPV6` (58) from the socket address family. - All v6 probes attach **best-effort** (`attach_optional_probe`, renamed from `attach_icmp_probe`) — a missing optional hook (IPv6 disabled, renamed symbol) must not take down core TCP/UDP attribution. - Userspace accepts proto 58 in `flow_key_from_record`; `transport_protocol` maps 58 → `"icmpv6"`. ### core - The pushed `FlowAttributionEvent` transport string `"icmpv6"` was being dropped by `flow_attribution.ex` (it only knew `icmp6`/`ipv6-icmp`), so ICMPv6 rows never reached `flow_process_attributions`. Both `transport_to_proto` mappings (`flow_attribution` + `attributed_flow_joiner`) now accept all three variants `icmp6`/`icmpv6`/`ipv6-icmp` → 58. ## Validation On a kernel 6.8 box (attribution-only mode), `flow_process_attributions` now carries: - **TCP** v4 + v6 (proto 6) - **UDP** v4 + v6 (proto 17) — v6 via `udpv6_sendmsg` - **ICMP** v4 (proto 1) - ICMPv6 kprobes fire and reach `FLOW_EVENTS` (`flow_to_pid` family=10 proto=58); end-to-end proto-58 rows land once this core proto-mapping fix is deployed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mfreeman451 added 2 commits 2026-06-04 19:49:51 +00:00

feat(netprobe): attribute UDP (real 5-tuple) + ICMP flows, not just TCP ... 576b2de066

netprobe only attributed TCP: the udp_sendmsg/udp_recvmsg kprobes emitted
FlowTuple::empty() (zero 5-tuple, dropped in userspace), and only the
inet_sock_set_state tracepoint (TCP-only) populated a tuple. So UDP (NTP, DNS)
and ICMP (ping) flows never got a process attribution.

- eBPF: read the real 5-tuple off `struct sock` (sock_common) in the UDP kprobes
  via a `socket_tuple` helper using offset_of! on a #[repr(C)] sock_common mirror
  (offsets validated against the committed vmlinux.h); fail-safe bpf_probe_read.
- ICMP: add ping_v4_sendmsg (dgram ICMP) + raw_sendmsg (raw ICMP) kprobes emitting
  proto=1 with the socket IPs and zero ports; attached BEST-EFFORT so a missing
  per-kernel symbol can't take down TCP/UDP attribution.
- userspace: accept proto 17 + proto 1 (ICMP has no ports → keep zero-port records).

Validated on kernel 6.8 (box 192.168.1.62), attribution-only mode: TCP/UDP/ICMP
all attributed (p6/p17/p1), UDP tuples correct (e.g. NTP 129.6.15.28:123, DNS
8.8.8.8:53 → comm=bash). No XDP/capture touched — no black-hole risk.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(netprobe): IPv6 UDP + ICMPv6 flow attribution (#3425) ... 9d807e6993

UDP-over-IPv6 traverses udpv6_sendmsg/udpv6_recvmsg, never the v4
udp_* path, so the v4-only hooks missed UDP/IPv6 entirely. Add
udpv6_sendmsg/udpv6_recvmsg kprobes sharing a new emit_udp helper
(socket_tuple already reads the address family, so one helper serves
both v4 and v6).

ICMPv6: add ping_v6_sendmsg/rawv6_sendmsg kprobes; emit_icmp_send now
derives IPPROTO_ICMPV6 (58) from the socket family so the protocol
stays consistent with the v6 addresses. All v6 probes attach
best-effort via attach_optional_probe (renamed from attach_icmp_probe)
- a missing optional hook (IPv6 disabled, renamed/inlined symbol) must
not take down the core TCP/UDP attribution that just loaded.

netprobe userspace: accept proto 58 in flow_key_from_record;
transport_protocol maps 58 -> "icmpv6".

core: the pushed FlowAttributionEvent transport string "icmpv6" was
dropped by flow_attribution.ex (it only recognized icmp6/ipv6-icmp),
so ICMPv6 rows never reached flow_process_attributions. Align both
transport_to_proto mappings (flow_attribution + attributed_flow_joiner)
to accept all three variants icmp6/icmpv6/ipv6-icmp -> 58.

Validated on a kernel 6.8 box (attribution-only mode): fpa now carries
TCP and UDP over both IPv4 and IPv6 (proto 6/17, v4+v6) plus ICMP v4;
ICMPv6 kprobes fire and reach FLOW_EVENTS (flow_to_pid family=10
proto=58).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mfreeman451 merged commit 4103ead8c7 into staging 2026-06-04 20:14:14 +00:00

mfreeman451 deleted branch feat/netprobe-udp-icmp 2026-06-04 20:14:14 +00:00

mfreeman451 referenced this pull request from a commit 2026-06-04 20:14:16 +00:00

Merge pull request 'feat(netprobe): IPv6 UDP + ICMPv6 flow attribution (#3425)' (#3528) from feat/netprobe-udp-icmp into staging

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

1week

  

2weeks

  

Failed compliance check

  

IP cameras

  

NATS

NATS JetStream

  

Possible security concern

  

Review effort 1/5

  

Review effort 2/5

  

Review effort 3/5

  

Review effort 4/5

  

Review effort 5/5

  

UI

  

aardvark

  

accessibility

  

amd64

  

api

  

arm64

  

auth

  

back-end

  

bgp

  

blog

  

bug

Something isn't working

  

build

  

checkers

  

ci-cd

continuous integration-continuous deployments

  

cleanup

  

cnpg

cloud-native postgres

  

codex

  

core

core service

  

dependencies

Pull requests that update a dependency file

  

device-management

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

dusk

  

ebpf

  

enhancement

New feature or request

  

eta 1d

  

eta 1hr

  

eta 3d

  

eta 3hr

  

feature

  

fieldsurvey

  

github_actions

Pull requests that update GitHub Actions code

  

go

Pull requests that update Go code

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

javascript

Pull requests that update Javascript code

  

k8s

  

log-collector

  

mapper

  

mtr

multi traceroute

  

needs-triage

  

netflow

  

network-sweep

  

observability

  

oracle

Oracle Linux related issues

  

otel

opentelemetry logs, traces, metrics

  

plug-in

  

proton

timeplus proton streaming database

  

python

  

question

Further information is requested

  

reddit

  

redhat

  

research

  

rperf

  

rperf-checker

  

rust

Pull requests that update rust code

  

sdk

  

security

  

serviceradar-agent

  

serviceradar-agent-gateway

  

serviceradar-web

  

serviceradar-web-ng

  

siem

  

snmp

  

sysmon

  

topology

  

ubiquiti

  

wasm

  

wontfix

This will not be worked on

  

zen-engine

No labels

1week

2weeks

Failed compliance check

IP cameras

NATS

Possible security concern

Review effort 1/5

Review effort 2/5

Review effort 3/5

Review effort 4/5

Review effort 5/5

UI

aardvark

accessibility

amd64

api

arm64

auth

back-end

bgp

blog

bug

build

checkers

ci-cd

cleanup

cnpg

codex

core

dependencies

device-management

documentation

duplicate

dusk

ebpf

enhancement

eta 1d

eta 1hr

eta 3d

eta 3hr

feature

fieldsurvey

github_actions

go

good first issue

help wanted

invalid

javascript

k8s

log-collector

mapper

mtr

needs-triage

netflow

network-sweep

observability

oracle

otel

plug-in

proton

python

question

reddit

redhat

research

rperf

rperf-checker

rust

sdk

security

serviceradar-agent

serviceradar-agent-gateway

serviceradar-web

serviceradar-web-ng

siem

snmp

sysmon

topology

ubiquiti

wasm

wontfix

zen-engine

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

carverauto/serviceradar!3528

No description provided.