Repository navigation
[Enhancement]: Improve agent API response when returning active connections #140
Description
Is your feature request related to a problem?
- Yes
Problem Description:
The api response for the active connections endpoint returns this type of output:
[SYSTEM] Founded config files
[SYSTEM] Readed configs for env variable: "Kubernetes"
=====> Connecting to cortexflow Client
=====> Connected to CortexFlow Client
{"\"35655\"": "\"143.171.168.192\"", "\"48872\"": "\"133.171.168.192\"", "\"35623\"": "\"148.171.168.192\"", "\"48807\"": "\"173.171.168.192\"", "\"60011\"": "\"136.171.168.192\"", "\"48551\"": "\"163.171.168.192\"", "\"48582\"": "\"129.171.168.192\"", "\"48580\"": "\"133.171.168.192\"", "\"100228\"": "\"147.171.168.192\"", "\"46616\"": "\"133.171.168.192\"", "\"36079\"": "\"136.171.168.192\"", "\"36077\"": "\"136.171.168.192\"", "\"43845\"": "\"131.171.168.192\"", "\"35619\"": "\"136.171.168.192\"", "\"45042\"": "\"135.171.168.192\"", "\"42669\"": "\"148.171.168.192\"", "\"49747\"": "\"143.171.168.192\"", "\"45305\"": "\"147.171.168.192\"", "\"45280\"": "\"147.171.168.192\"", "0": "0", "\"45281\"": "\"147.171.168.192\"", "\"36682\"": "\"136.171.168.192\"", "\"35631\"": "\"148.171.168.192\"", "\"42722\"": "\"148.171.168.192\"", "\"44074\"": "\"136.171.168.192\"", "\"45\"": "\"133.171.168.192\"", "\"44335\"": "\"136.171.168.192\"", "\"35625\"": "\"148.171.168.192\"", "\"32\"": "\"156.171.168.192\"", "\"36073\"": "\"135.171.168.192\"", "\"49748\"": "\"143.171.168.192\"", "\"45282\"": "\"147.171.168.192\"", "\"49380\"": "\"129.171.168.192\"", "\"35620\"": "\"148.171.168.192\"", "\"90399\"": "\"158.171.168.192\"", "\"49077\"": "\"143.171.168.192\"", "\"45312\"": "\"147.171.168.192\"", "\"49383\"": "\"133.171.168.192\"", "\"48581\"": "\"133.171.168.192\"", "\"48809\"": "\"173.171.168.192\"", "\"49379\"": "\"156.171.168.192\"", "\"0\"": "\"173.171.168.192\"", "\"42725\"": "\"148.171.168.192\"", "\"42721\"": "\"148.171.168.192\"", "\"44075\"": "\"136.171.168.192\"", "\"41299\"": "\"135.171.168.192\"", "\"16\"": "\"143.171.168.192\"", "\"44071\"": "\"136.171.168.192\"", "\"42720\"": "\"148.171.168.192\""}
The first number is associated with the event ID, while the second number represents the scanned IP.
This is the current schema:
{
"event_id":,
"src_ip":
}
This type of output is visually messy and doesn't give enough information to the user.
Solution:
The response can be improved by refactoring the output as follows:
{
"event_id":,
"src_ip/src_port":,
"dst_ip/src_port":,
}
Additional info:
API proto file: agent.proto
API implementation: api.rs
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
[CortexFlow#140]: Improve agent API response
siddh34 commentedon Oct 12, 2025
@LorenzoTettamanti got it working mate, let me know about the format
[CortexFlow#140]: Improve agent API response
[CortexFlow#140]: Improve agent API response
[CortexFlow#140]: Improve agent API response
[CortexFlow#140]: Improve agent API response
Merge pull request #145 from siddh34/feature/ebpf-core
LorenzoTettamanti commentedon Oct 13, 2025
@siddh34 Hey mate, everything is working! Unfortunately i can't replicate this exact result. Do you also have updated the CLI right?
siddh34 commentedon Oct 13, 2025
@LorenzoTettamanti Yes mate! unfortunately I can't see your image
although I had to a little kubectl port forward for it
LorenzoTettamanti commentedon Oct 13, 2025
@siddh34 Can you raise a PR to match the agent API response format? It would be great if you could format the CLI response like the one I can see in your 2nd image :)
Today, I merged your updates with mine in the ebpf_core branch. I've also tagged the Docker image with the "0.1.1.beta.x" tag.
Docker images:
agent: https://hub.docker.com/r/lorenzotettamanti/cortexflow-agent
identity: https://hub.docker.com/r/lorenzotettamanti/cortexflow-identity
issue #105 update:
I'm working on a PR to fix a couple of bugs in the policy command. I'm ensuring that the blocklist works properly. Up to now, if you sync the repo you will see that the addresses are exposed in the right order (previously: 1.1.168.192 (reversed order) ----> now: 192.168.1.1). You will also see that the policy command is available, but right now you can't really block anything (the PR will come at the end of the week)
LorenzoTettamanti commentedon Oct 13, 2025
@siddh34 P.S. if you need to run some quick tests now you can use the docker images with the beta tag linked above
siddh34 commentedon Oct 20, 2025
@LorenzoTettamanti sorry for late reply mate but I am not able to find the structure which I used
on my side, which I updated a long time ago
I will still update the cli, via local try to push changes that doesn't break release cycle
[CortexFlow#140]: cli output improved
LorenzoTettamanti commentedon Oct 20, 2025
@siddh34 Thanks for reporting this issue. I haven't pushed any new beta version on crates.io so this is why you are seeing the old outdated code.
This is the latest version of the agent.proto file https://github.com/CortexFlow/CortexBrain/blob/feature%2Febpf-core/core%2Fapi%2Fprotos%2Fagent.proto
Let me know you if you still have any divergences!
Tomorrow i'll merge all the opened PR and i'll push the 0.1.1-beta.1 release on crates.io.
Probably you might find it easier working with the local crates instead of using the uploaded one on crates.io. i'll suggest you to use the tagged versions (e.g. 0.1.0, 0.1.1-beta.0) as a backup because the only reason why i've started uploading the identity and agent crates is because you can't upload the CLI with local dependencies. If you need to write new features or update existing ones you can use the local path for the module that you need, just make sure that you local branch is synced with the root
Merge pull request #147 from siddh34/feature/ebpf-core
siddh34 commentedon Oct 21, 2025
@LorenzoTettamanti cool, let me know if anything left in this issue or we can close this one!
[CortexFlow#140]: only print 0 events via info macro
Merge pull request #148 from siddh34/feature/ebpf-core