Sometimes the tuple of the captured http2 packet is 0

Hello! 
When I use this tool to capture http2 packets, sometimes the tuple of the packets is 0, that is, 0.0.0.0:0-0.0.0.0:0.
And I have not stopped the running of the tool during the capture. 

Here are the results of my run, this question seems to arise easily.
"DestroyConn success fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443" printed before printing tuple information, maybe because the connection was destroyed when the tuple was fetched.
```
# ./ecapture-ctyun tls -i ens1f0 -d
2025-02-18T14:20:45+08:00 INF AppName="eCapture(旁观者)"
2025-02-18T14:20:45+08:00 INF HomePage=https://ecapture.cc
2025-02-18T14:20:45+08:00 INF Repository=https://github.com/gojue/ecapture
2025-02-18T14:20:45+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2025-02-18T14:20:45+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2025-02-18T14:20:45+08:00 INF Version=linux_amd64:v0.9.3-20250210-dcfc3cf:x86_64
2025-02-18T14:20:45+08:00 INF Listen=localhost:28256
2025-02-18T14:20:45+08:00 INF eCapture running logs logger=
2025-02-18T14:20:45+08:00 INF the file handler that receives the captured event eventCollector=
2025-02-18T14:20:45+08:00 INF listen=localhost:28256
2025-02-18T14:20:45+08:00 INF https server starting...You can upgrade the configuration file via the HTTP interface.
2025-02-18T14:20:45+08:00 WRN Kernel version is less than 5.2, Process filtering parameters do not take effect such as pid/uid. kernel=4.19.90
2025-02-18T14:20:45+08:00 INF Kernel Info=4.19.90 Pid=396298
2025-02-18T14:20:45+08:00 INF BTF bytecode mode: non-CORE. btfMode=0
2025-02-18T14:20:45+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2025-02-18T14:20:45+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2025-02-18T14:20:45+08:00 INF Module.Run()
2025-02-18T14:20:45+08:00 INF origin versionKey="openssl 1.1.1f" versionKeyLower="openssl 1.1.1f"
2025-02-18T14:20:45+08:00 INF OpenSSL/BoringSSL version found Android=false library version="openssl 1.1.1f"
2025-02-18T14:20:45+08:00 INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/lib64/libssl.so.1.1
2025-02-18T14:20:45+08:00 WRN Your kernel version is less than 5.2, GlobalVar is disabled, the following parameters will be ignored:[target_pid, target_uid, target_port]
2025-02-18T14:20:45+08:00 INF setupManagers eBPFProgramType=Text
2025-02-18T14:20:45+08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_1_1_1d_kern_noncore_less52.o
2025-02-18T14:20:45+08:00 DBG upgrade check failed: local version is ahead of latest version
2025-02-18T14:20:46+08:00 INF perfEventReader created mapSize(MB)=4
2025-02-18T14:20:46+08:00 INF perfEventReader created mapSize(MB)=4
2025-02-18T14:20:46+08:00 INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL
2025-02-18T14:20:48+08:00 DBG AddConn success fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG DestroyConn success fd=5 pid=396386 tuple=192.168.10.201:41370-192.168.10.41:4443
2025-02-18T14:20:48+08:00 DBG GetConn fd=5 pid=396386
2025-02-18T14:20:48+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=396386 tuple=[TUPLE_NOT_FOUND]
2025-02-18T14:20:49+08:00 ??? UUID:396386_396386_curl_5_1_192.168.10.201:41370-192.168.10.41:4443, Name:HTTP2Request, Type:2, Length:392

Frame Type      =>      SETTINGS
Frame StreamID  =>      0

Frame Type      =>      WINDOW_UPDATE
Frame StreamID  =>      0

Frame Type      =>      HEADERS
Frame StreamID  =>      1
header field ":method" = "GET"
header field ":path" = "/"
header field ":scheme" = "https"
header field ":authority" = "192.168.10.41:4443"
header field "user-agent" = "curl/7.71.1"
header field "accept" = "*/*"

Frame Type      =>      SETTINGS
Frame StreamID  =>      0

2025-02-18T14:20:49+08:00 ??? UUID:396386_396386_curl_5_0_192.168.10.201:41370-192.168.10.41:4443, Name:HTTP2Response, Type:4, Length:137

Frame Type      =>      SETTINGS
Frame StreamID  =>      0

Frame Type      =>      WINDOW_UPDATE
Frame StreamID  =>      0

Frame Type      =>      SETTINGS
Frame StreamID  =>      0

2025-02-18T14:20:49+08:00 ??? UUID:396386_396386_curl_5_0_0.0.0.0:0-0.0.0.0:0, Name:HTTP2Response, Type:4, Length:2089

Frame Type      =>      HEADERS
Frame StreamID  =>      1
header field ":status" = "200"
header field "server" = "nginx/1.21.5"
header field "date" = "Tue, 18 Feb 2025 06:20:48 GMT"
header field "content-type" = "text/html"

Frame Type      =>      DATA
Frame StreamID  =>      1
<html>
<head><title>Index of /</title></head>
<body>
<h1>Index of /</h1><hr><pre><a href="../">../</a>
<a href="bak/">bak/</a>                                               18-Dec-2024 09:59       -
<a href="http2_test/">http2_test/</a>                                        17-Feb-2025 15:10       -
<a href="iso/">iso/</a>                                               22-Jan-2025 15:22       -
<a href="small/">small/</a>                                             19-Dec-2024 15:35       -
<a href="temp/">temp/</a>                                              18-Dec-2024 10:25       -
<a href="1.txt">1.txt</a>                                              23-Dec-2024 10:20      12
<a href="config.txt">config.txt</a>                                         23-Dec-2024 09:19     87K
</pre><hr></body>
</html>

……
```

Expect your reply!


Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Sometimes the tuple of the captured http2 packet is 0 #739

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Sometimes the tuple of the captured http2 packet is 0 #739

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions