4 ms·
This is very easy to accomplish with eBPF, which OpenSnitch appears to use, but I didn't review it sufficiently to determine if that's how they're associating p
by xyzzy_plugh 4y ago
This is very easy to accomplish with eBPF, which OpenSnitch appears to use, but I didn't review it sufficiently to determine if that's how they're associating processes with packets.
IIRC the problem with tagging in Linux is that there isn't necessarily a 1:1 relationship with a destination PID and a packet in a variety of scenarios.