System socket dataset

This is the socket dataset of the system module. It allows to monitor network traffic to and from running processes. It’s main features are:

This dataset does not analyze application-layer protocols nor provide any other advanced features present in Packetbeat: - Monitor network traffic whose destination is not a local process, as is the case with traffic forwarding. - Monitor layer 2 traffic, ICMP or raw sockets.

It is implemented for Linux only and currently supports x86 (32 and 64 bit) architectures.

The dataset uses KProbe-based event tracing to monitor TCP and UDP sockets over IPv4 and IPv6, providing flow monitoring that includes byte and packet counters, as well as the local process and user involved in the flow. It does so by plugin into the TCP/IP stack to generate custom tracing events avoiding the need to copy network traffic to user space.

By not relying on periodic polling, this approach enables the dataset to perform near real-time monitoring of the system without the risk of missing short lived connections or processes.

Features used by the socket dataset require a minimum Linux kernel version of 3.12 (vanilla). However, some distributions have backported those features to older kernels. The following (non-exhaustive) lists the different distributions under which the dataset is known to work:

[1]: These systems lack PERF_EVENT_IOC_ID ioctl. Support might be added in a future release.

The dataset needs CAP_SYS_ADMIN and CAP_NET_ADMIN in order to work.

A kernel built with the following configuration options enabled is required:

These settings are enabled by default in most distributions.

The following configuration settings can prevent the dataset from starting:

The dataset can monitor the Docker host when running inside a container. However it needs to run on a privileged container with CAP_NET_ADMIN. The docker container running Auditbeat needs access to the host’s tracefs or debugfs directory. This is achieved by bind-mounting /sys.

The following options are available for the socket dataset:

Must point to the mount-point of tracefs or the tracing directory inside debugfs. If this option is not specified, Auditbeat will look for the default locations: /sys/kernel/tracing and /sys/kernel/debug/tracing. If not found, it will attempt to mount tracefs and debugfs at their default locations.

Determines whether IPv6 must be monitored. When unset (default), IPv6 support is automatically detected. Even when IPv6 is disabled, in order to run the dataset you still need a kernel with IPv6 support (the ipv6 module must be loaded if compiled as a module).

Determines how long a flow has to be inactive to be considered closed.

Determines how long to wait after a socket has been closed for out of order packets. With TCP, some packets can be received shortly after a socket is closed. If set too low, additional flows will be generated for those packets.

The number of tracing samples that can be queued for processing. A larger value uses more memory but reduces the chances of samples being lost when the system is under heavy load.

The number of lost samples notifications that can be queued.

Controls the number of memory pages allocated for the per-CPU ring-buffer used to receive samples from the kernel. The actual amount of memory used is Number_of_CPUs x Page_Size(4KB) x 2^{ring_size_exponent}. That is 0.5 MiB of RAM per CPU with the default value.

Defines the maximum difference between the kernel internal clock and the reference time used to timestamp events.

Controls how often clock synchronization events are generated to measure drift between the kernel clock and the dataset’s reference clock.

The maximum time an individual guess is allowed to run.

If DNS traffic must be monitored to enrich network flows with DNS information.

The method used to monitor DNS traffic. Currently, only af_packet is supported.

The network interface where DNS will be monitored.

Maximum number of bytes to copy for each captured packet.

{
    "@timestamp":"2019-08-22T20:46:40.173Z",
    "@metadata":{
        "beat":"auditbeat",
        "type":"_doc",
        "version":"7.4.0"
    },
    "server":{
        "ip":"151.101.66.217",
        "port":80,
        "packets":5,
        "bytes":437
    },
    "user":{
        "name":"vagrant",
        "id":"1000"
    },
    "network":{
        "packets":10,
        "bytes":731,
        "community_id":"1:jdjL1TkdpF1v1GM0+JxRRp+V7KI=",
        "direction":"outbound",
        "type":"ipv4",
        "transport":"tcp"
    },
    "group":{
        "id":"1000",
        "name":"vagrant"
    },
    "client":{
        "ip":"10.0.2.15",
        "port":40192,
        "packets":5,
        "bytes":294
    },
    "event":{
        "duration":30728600,
        "module":"system",
        "dataset":"socket",
        "kind":"event",
        "action":"network_flow",
        "category":"network_traffic",
        "start":"2019-08-22T20:46:35.001Z",
        "end":"2019-08-22T20:46:35.032Z"
    },
    "ecs":{
        "version":"1.0.1"
    },
    "host":{
        "name":"stretch",
        "containerized":false,
        "hostname":"stretch",
        "architecture":"x86_64",
        "os":{
            "name":"Debian GNU/Linux",
            "kernel":"4.9.0-8-amd64",
            "codename":"stretch",
            "platform":"debian",
            "version":"9 (stretch)",
            "family":"debian"
        },
        "id":"b3531219b5b4449eadbec59d47945649"
    },
    "agent":{
        "version":"7.4.0",
        "type":"auditbeat",
        "ephemeral_id":"f7b0ab1a-da9e-4525-9252-59ecb68139f8",
        "hostname":"stretch",
        "id":"88862e07-b13a-4166-b1ef-b3e55b4a0cf2"
    },
    "process":{
        "pid":4970,
        "name":"curl",
        "args":[
            "curl",
            "http://elastic.co/",
            "-o",
            "/dev/null"
        ],
        "executable":"/usr/bin/curl",
        "created":"2019-08-22T20:46:34.928Z"
    },
    "system":{
        "audit":{
            "socket":{
                "kernel_sock_address":"0xffff8de29d337000",
                "internal_version":"1.0.3",
                "uid":1000,
                "gid":1000,
                "euid":1000,
                "egid":1000
            }
        }
    },
    "destination":{
        "ip":"151.101.66.217",
        "port":80,
        "packets":5,
        "bytes":437
    },
    "source":{
        "port":40192,
        "packets":5,
        "bytes":294,
        "ip":"10.0.2.15"
    },
    "flow":{
        "final":true,
        "complete":true
    },
    "service":{
        "type":"system"
    }
}