Endpoints and TLS

Endpoint probes collect plaintext before encryption and after decryption inside an application. They need no TLS private key, do not proxy or terminate connections, and cannot recover arbitrary mirrored ciphertext.

Connect one application

Generate files in a fresh directory. Replace /opt/billing/server with the exact absolute path shown by /proc/PID/exe:

netflowscout configure --service billing --executable /opt/billing/server \
  --verification --out ./netflowscout.json --endpoint-out ./billing.json
netflowscout check --config ./netflowscout.json
sudo netflowscout doctor --config ./netflowscout.json --endpoint-config ./billing.json

New configurations default to module/protocol/role=auto. Automatic module selection requires one identifiable supported runtime. For mixed Go/OpenSSL targets, explicitly choose gotls or openssl. Multiple libssl mappings require a library path inside the target filesystem. A readable path or Go build info is only a preflight result.

Install the main configuration and rules as root:netflowscout / 0640, and endpoint files as root / 0600. Their stream_socket must match the main configuration. See installation for service startup.

Discovery and reattachment

Discovery identity includes PID, start time, executable inode, and cgroup. Exit, exec, or cgroup changes retire the old probe and trigger a new attachment. Process-generation checks prevent attribution to a reused PID.

Option	Meaning
match.executable	Exact path; no wildcard or symlink alias
match.uid	Real UID restriction
match.cgroup_prefix	Service/container scope with path boundaries
poll_ms	Default 1000; range 100–60000
max_targets	Default 8; range 1–16, one probe per target
runtime_dir	Unique absolute path, at most 70 bytes, owned by the current UID with mode 0700

Polling, attachment, and subscription create gaps. Short-lived processes, earlier requests, and earlier prepared statements cannot be recovered. Wait for attached before the first verification request and again after application restarts.

Manage several services

Download the complete policies example and adapt it. Merge this core structure into a complete endpoint configuration:

{
  "policies": [
    {"id":"skip-maintenance","exclude":true,"match":{"cgroup_prefix":"/system.slice/maintenance.service"}},
    {"id":"billing","priority":20,"service":"billing","match":{"executable":"/opt/billing/server"}},
    {"id":"orders","priority":10,"service":"orders","module":"gotls","match":{"executable":"/opt/orders/server"}}
  ]
}

policies and a root-level match are mutually exclusive. Exclusions win, then the highest priority is selected. Equal-priority inclusion conflicts reject the target. Keep separate discovery instances mutually exclusive. Restart discovery after changing policies or plugin detection declarations.

Attribution and protocol detection

Observations include service, PID, process start time, executable, network namespace, cgroup, and container metadata. process.start_ns is a decimal string to preserve precision. A window spanning process generations does not inherit the first process's identity. Group by both process.pid, process.start_ns for per-process alerts.

Plugin signatures and port hints identify protocols and local client/server roles. Set protocol/role/connections explicitly when ports are unusual or signatures ambiguous. Unknown-stream buffering has byte, callback, and time limits. Custom endpoint protocols must use the same plugins directory as the analyzer.

HTTP/3 needs the separate goquic probe. See protocol support for version, symbol, and QPACK restrictions.