Correlating network traffic to their OS processes using packet capture libraries and kernel monitoring mechanisms
A method of monitoring and reporting of packets including their attribution to their origin processes from a user space application without installing proprietary drivers, rather using only infrastructures and capabilities supplied by the operating system (OS). The method relies on correlation between packets received from a packet capture library and a kernel monitoring mechanism that supplies an event with the process ID which is executed on the same time frame for transmitting or receiving of that traffic. The attribution between the event and the packet is based on the 4-tuple (or other exemplar) that exists on both the event and the packet where the “4-tuple” is a set of: source address, source port, destination address, destination port.
1. A method for discovering the origin of network traffic on a computer running an operating system (OS) comprising:
monitoring, by a first tool of the operating system, a port of the computer for domain name system (DNS) communications;
upon detecting a DNS communication, capturing, via the first tool, at least packet headers of transmitted or received packets of the DNS communication, said first tool reporting a first exemplar for each packet captured;
monitoring, by a second tool of the operating system, a kernel of the operating system for kernel events;
upon detecting a kernel event, identifying, via the second tool, a second exemplar for each packet transmitted or received by the kernel event and a process identification (PID) of the kernel event transmitting or receiving each packet;
comparing captured first exemplars from the DNS communication to second exemplars from the kernel event;
determining that the DNS communication and the kernel event occurred within a predetermined time window; and
based on the determining, reporting the originating PID of the DNS communication when said exemplars match within the predetermined time window.
2. The method of claim 1 wherein each of said first exemplar and said second exemplar is a 4-tuple containing source address, source port, destination address and destination port.
3. The method of claim 1 wherein the predetermined time window is approximately one second.
4. The method of claim 1 wherein the first tool is libpcap.
5. The method of claim 1 wherein the second tool is KProbes.
6. The method of claim 1 wherein the first tool is Winpcap or NDISCapture.
7. The method of claim 1 wherein the second tool is EventViewer.
8. A method for discovering the origin of network traffic on a computer running an operating system (OS) comprising:
monitoring, by a first tool of the operating system, a port of the computer for domain name system (DNS) communications;
upon detecting a DNS communication, capturing packet data and an identifying 4-tuple for each packet captured;
monitoring, by a second tool of the operating system, a kernel of the operating system for kernel events;
upon detecting a kernel event, capturing, by the second tool, an identifying 4-tuple for each kernel event a process identification (PID) of the kernel event;
comparing captured 4-tuples from captured packets to 4-tuples from kernel events that occur within a predetermined time window; and
reporting the originating PID of the DNS request when said 4-tuples match within the predetermined time window.
9. The method of claim 8 wherein the port is Port 53.
10. The method of claim 8 wherein the predetermined time window is approximately one second.
11. The method of claim 8 wherein the first tool is libpcap.
12. The method of claim 8 wherein the second tool is a KProbe.
13. The method of claim 8 wherein the first tool is Winpcap or NDISCapture.
14. The method of claim 8 wherein the second tool is EventViewer.
15. A method of discovering an origin of network traffic via an operating system of a computer comprising:
capturing a packet of data from a port of the computer;
upon capturing the packet, determining a first exemplar identifying the captured packet;
detecting a kernel packet transmit event by monitoring a kernel of the computer;
upon detecting the kernel packet transmit event, determining a second exemplar identifying the kernel packet transmit event;
correlating the captured packet with the kernel packet transmit event in a predetermined time interval by matching the first and second exemplars.
16. The method of claim 15 wherein the correlation occurs when the captured packet and the kernel packet transmit event include the same 4-tuple occurring within the predetermined time interval.
17. The method of claim 16 wherein the predetermined time window is approximately one second.
18. The method of claim 15 wherein the origin of the network traffic implicates a particular process.
19. The method of claim 15 wherein the network traffic is a DNS communication.
20. The method of claim 15 wherein capture of the packet and the kernel packet transmit event are effected by using infrastructures and capabilities supplied by the operating system (OS).