Auditing network traffic

[Lev Stipakov]

Hello,

I work on an audisp plugin which audits network traffic – what process 
has send/received data to/from what remote address. So far I see 2 ways 
of accomplishing that:

Hook syscalls. First, hook socket call with af_inet/inet6 to get pid and 
fd, then read/write/sendto/recvfrom filtered by pid and fd. I see few 
issues with this appoach:

1) Fd can be closed or duped, so I should probably hook close/dup2 calls 
too. Not sure, though, if socket could be closed by kernel without any 
syscall. As a workaroud, one can just hook read/write and check if fd is 
socket (S_ISSOCK) and also somehow filter out af_unix.

2) Getting saddr/daddr. Seems that dest addr could be obtained from 
connect call. However I am not sure what is the right way to get that - 
I got two records, first SYSCALL and then SOCKADDR. First one has an 
argument which points to memory location where sockaddr structure lays, 
and second one has ”saddr” field.  Latter looks good, but does SOCKADDR 
event type always follows SYSCALL for connect call? Same for sendto call.

Another way of getting network stats is the AUDIT target for netfilter. 
Looks good, no need to worry about fds/addrs. However there is no pid. 
What would be the ”best” way to get pid for those records? Anything else 
besides looking into /proc/net/tcp?

-Lev