feat: add AF_PACKET flow collector to agent for real VM traffic visibility with IPv4 TCP/UDP/ICMP flow extraction

Add packet flow collector in agent v0.2.0 using Linux AF_PACKET sockets to capture and aggregate IPv4 TCP/UDP/ICMP flows from VM interfaces (tap/fwln) with configurable window/limit, implement parse_packet_flow to extract 5-tuple from raw Ethernet frames with VLAN tag handling, add selected_flow_interfaces to choose best interface per VM NIC for packet capture, include packet collector
This commit is contained in:
2026-07-09 15:18:35 +02:00
parent 3bfd77a74a
commit 4ceb4489c5
3 changed files with 189 additions and 11 deletions
+2
View File
@@ -706,6 +706,8 @@ cat > "$CONFIG_DIR/config.json" <<'JSON'
"node_name": "{node.name}",
"interval_seconds": 30,
"flow_limit": 500,
"packet_flow_collector": true,
"packet_flow_window_seconds": 10,
"verify_tls": true
}}
JSON