How to watch for new network connections TTL

Question

I need to watch for new connections accept() TTL and collect them for further investigation.

tcpdump can show TTL for packets, but can't show only accept() connections. I've tried iovisor/bcc and tcpaccept is doing well, but doesn't show TTL.

Cloudflare has great post about extracting TTL from connection, but it works only with socket you've created.

Does anybody know how make this right?

UPDATED: not accept() but inet_csk_accept()

Who says `tcpdump` can't do that?! `tcpdump -i "tcp[tcpflags] & (tcp-ack) != 0"` — tink, May 28 '19 at 22:26
@tink it floods all packets to CLI and tcpaccept show only events from kretprobe__inet_csk_accept — it4ddict, May 29 '19 at 06:16

score -1 · Accepted Answer · answered Jun 10 '19 at 17:14

-1

As a result of this question I've written a post.
tcpdump can be used to get TTL, but it makes it for every packet and to get TTL for inet_csk_accept() we need to go deeper with eBPF, so I've created an issue at iovisor/bcc repo.

answered Jun 10 '19 at 17:14

it4ddict

29
5

How to watch for new network connections TTL

1 Answers1