{"action":"opened","issue":{"url":"https://api.github.com/repos/weaveworks/scope/issues/2647","repository_url":"https://api.github.com/repos/weaveworks/scope","labels_url":"https://api.github.com/repos/weaveworks/scope/issues/2647/labels{/name}","comments_url":"https://api.github.com/repos/weaveworks/scope/issues/2647/comments","events_url":"https://api.github.com/repos/weaveworks/scope/issues/2647/events","html_url":"https://github.com/weaveworks/scope/issues/2647","id":238457460,"number":2647,"title":"different process association of existing vs new connections","user":{"login":"rade","id":109109,"avatar_url":"https://avatars0.githubusercontent.com/u/109109?v=3","gravatar_id":"","url":"https://api.github.com/users/rade","html_url":"https://github.com/rade","followers_url":"https://api.github.com/users/rade/followers","following_url":"https://api.github.com/users/rade/following{/other_user}","gists_url":"https://api.github.com/users/rade/gists{/gist_id}","starred_url":"https://api.github.com/users/rade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rade/subscriptions","organizations_url":"https://api.github.com/users/rade/orgs","repos_url":"https://api.github.com/users/rade/repos","events_url":"https://api.github.com/users/rade/events{/privacy}","received_events_url":"https://api.github.com/users/rade/received_events","type":"User","site_admin":false},"labels":[{"id":515775993,"url":"https://api.github.com/repos/weaveworks/scope/labels/accuracy","name":"accuracy","color":"dbd37a","default":false},{"id":204695843,"url":"https://api.github.com/repos/weaveworks/scope/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-06-26T07:08:42Z","updated_at":"2017-06-26T07:08:42Z","closed_at":null,"body":"On probe startup, eBPF connection tracking grabs the initial set of already existing connections via the same `/proc` traversal as we do when eBPF is disabled. There is a crucial difference between the two methods: `/proc` traversal associates endpoints with the processes that own the sockets, whereas eBPF associates endpoints with processes that call `connect()` (outbound) and `accept()` (inbound). This won't yield the same result when socket fds are passed between processes after these system calls.\r\n\r\nPer #2253, eBPF is oblivious to fd transfers. The problem is compounded here. Watch a process switch endpoints:\r\n\r\n1. run `tcpserver -v 0 1122 cat`\r\n2. run `nc localhost 1122`\r\n3. launch scope and navigate to process topology, which contains\r\n![screenshot from 2017-06-26 07-51-17](https://user-images.githubusercontent.com/109109/27528017-573b3126-5a46-11e7-8530-d995bc0b9748.png)\r\n4. run `nc localhost 1122`; wait a few secs for the process topology to update to\r\n![screenshot from 2017-06-26 07-52-06](https://user-images.githubusercontent.com/109109/27528046-6c8f1178-5a46-11e7-9111-aebae150924d.png)"}}
{"actor":{"display_login":"rade"}}