Source-based capture of clear text from encrypted data traffic for network traffic visibility processing

Abstract

A call to a packet encryption / decryption function 612 / 614 implemented in a worker node 516 is detected. In response to detecting the call, a clear text payload of the packet is captured from an entry point 616 / 620 or an exit point 618 of the encryption / decryption function 612 / 614. A modified packet is then created based on the captured clear text payload, including appending a plurality of synthesized headers. The modified packet is then sent to a processing entity that is external to the worker node 516. The detection and capture may be implemented using software hooks such as eBPF uprobe hooks. The workload application 604 may be a TLS application and the encryption / decryption function 612 / 614 may be part of an SSL library 608. The worker node 516 may be in a containerized environment or may be a virtual machine.

Images