feat(nat-lab): capture Windows tunnel adapter traffic in pcaps (LLT-7429)#1824
Merged
Conversation
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
23acf50 to
b2ba365
Compare
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
b2ba365 to
2fdba78
Compare
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
2fdba78 to
493904e
Compare
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
ecb2586 to
351b203
Compare
stalowyjez
reviewed
Jun 30, 2026
gytsto
added a commit
that referenced
this pull request
Jul 1, 2026
Address review on PR #1824: - rename _roll -> _reload_pktmon_with_new_adapters for clarity - name the triggering adapter(s) in the roll success log
gytsto
added a commit
that referenced
this pull request
Jul 1, 2026
Address review on PR #1824: - rename _roll -> _reload_pktmon_with_new_adapters for clarity - name the triggering adapter(s) in the roll success log
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
4da8485 to
ebd5b7b
Compare
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
gytsto
added a commit
that referenced
this pull request
Jul 1, 2026
Address review on PR #1824: - rename _roll -> _reload_pktmon_with_new_adapters for clarity - name the triggering adapter(s) in the roll success log
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
ebd5b7b to
12649f7
Compare
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
5e82a64 to
12649f7
Compare
…429) pktmon enumerates adapters only at session start, so libtelio's wireguard/wintun tunnel adapter - created after capture begins - was missing from Windows pcaps; decrypted tunnel traffic was only visible in the counterpart node's pcap. - Capture with `--comp all` and poll for adapters that appear after start; roll the pktmon session (stop/restart) when one does, splitting the capture into numbered pcap segments. - Normalise each downloaded pcap: wrap the tunnel adapter's bare-IP packets in a synthetic Ethernet header so Wireshark renders them, and drop the SSH control channel (unfilterable at capture time), replacing the old tcpdump-based strip. Best-effort: capturing the tunnel adapter depends on it living long enough for the roll to fire.
… one pcap - Roll the pktmon session with one `cmd /c "pktmon stop && pktmon start"` instead of two SSH round-trips, shrinking the capture blind window to pktmon's own restart (sessions can't overlap - one per machine). - Merge the downloaded segments into a single continuous, normalised pcap per node (merge_windows_pcaps) instead of leaving them as separate files; raw segments are kept as separate pcaps if the merge fails.
- _roll: register the new .etl and adopt the new baseline before the stop&&start, so a failing roll can't re-fire every poll or orphan an .etl. - _download_pktmon_segments: guard each segment download so one bad segment doesn't lose the rest or skip remote cleanup. - merge: drop only TCP/22 (SSH is TCP); use asyncio.to_thread. - find_unique_path_for_tcpdump: drop stray ./ prefix on rolled-over names.
Address review on PR #1824: - rename _roll -> _reload_pktmon_with_new_adapters for clarity - name the triggering adapter(s) in the roll success log
gytsto
force-pushed
the
gytsto/LLT-7429_natlab_windows_tunnel_capture
branch
from
12649f7 to
fc9f629
Compare
asledzinskiy
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
pktmon enumerates adapters only at session start, so libtelio's wireguard/wintun tunnel adapter (created later) was missing from Windows pcaps — decrypted tunnel traffic only showed up in the peer's pcap. Follow-up to #1818.
Solution
--comp all; poll for new adapters and roll the session (singlecmd /c "pktmon stop && pktmon start") when the tunnel adapter appears.<guest>.pcapper node, normalising in the same pass: wrap the tunnel adapter's bare-IP packets in Ethernet framing, drop the SSH control channel. Replaces the old tcpdump-based strip.Known limitations: best-effort (depends on the tunnel adapter living long enough to roll); the brief stop→start gap shows as a small discontinuity; raw segments are kept if the merge fails.
Closes LLT-7429.
☑️ Definition of Done checklist