B.7 destination.*
Every field the catalogue defines under destination, in path order. Each entry gives the field's definition and, under Carried by, every event type that writes it.
B.7.1 destination.address #
- Type:
str.ip - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The address the traffic was going to, rendered in the textual form for its family.
Carried by:
B.7.2 destination.attribution #
- Type:
str.enum - Values:
socket-stamp·no-kacs-state·unstamped·no-namespace·loopback-sender-lost·time-wait·stack-handled·no-sending-socket·multicast-or-broadcast·no-receiver·principal-unreadable - Set: open
- Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
Why the destination endpoint was given the attribution it has. Not
emitted today: NTFE decides it on every flow and encodes it nowhere, so
destination.endpoint and destination.unattributed are all a record
carries. The values are those of source.attribution;
multicast-or-broadcast and no-receiver are the inbound paths that give
shared and none.
Carried by:
No event carries this field yet.
B.7.3 destination.endpoint #
- Type:
str.enum - Values:
program·kernel·shared·none - Set: closed
- Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
What stands at the destination end of the traffic, when that end is on this
machine. program is a process's socket, and the destination.socket.*
fields then say whose. kernel is the network stack itself. shared is
inbound multicast or broadcast, delivered to every socket bound to the
port and so attributable to none of them. none means nothing on the
machine will receive the traffic: a port nobody is listening on, which is
the signature of a port scan. Present only on flow-layer records, and absent
when the destination is a remote machine.
Carried by:
No event carries this field yet.
B.7.4 destination.file.parent.inode #
- Type:
uint - Asserted: no
- Carried in: the payload
- Defined in:
kernel.evman
The inode number of the directory a rename moves an object into. Subject
to the same caveats as object.file.inode.
Carried by:
No event carries this field yet.
B.7.5 destination.file.path #
- Type:
str.path - Asserted: no
- Carried in: the payload
- Defined in:
kernel.evman
The path an object went to, in an operation on two objects such as a
rename or a link. Where it came from is source.file.path.
Carried by:
No event carries this field yet.
B.7.6 destination.mac #
- Type:
str - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The link-layer address the traffic was going to, written as six
colon-separated lowercase hexadecimal octets. Known only from a frame's
Ethernet header, so it is absent for outbound traffic judged at the IP
seats, where the frame has not been built yet, even when source.mac is
present.
Carried by:
No event carries this field yet.
B.7.7 destination.port #
- Type:
uint - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The transport port the traffic was going to. Present only for protocols that have ports.
Carried by:
B.7.8 destination.socket.process.guid #
- Type:
bin.guid - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The durable GUID of the process recorded on the destination endpoint's socket when it was stamped. Unlike the process ID it is never reused, so it still names the right process after that process has exited.
Carried by:
No event carries this field yet.
B.7.9 destination.socket.process.name #
- Type:
str - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The short name of the process recorded on the destination endpoint's socket when it was stamped. It is the kernel's command name, at most 15 characters and lossily sanitised, so two different programs can share it; it is a hint for a person, not an identity.
Carried by:
No event carries this field yet.
B.7.10 destination.socket.process.pid #
- Type:
uint - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The process ID recorded on the destination endpoint's socket when it was
stamped. A socket can outlive the process that created it, so this process
may have exited and its ID been reused; destination.socket.process.guid
is the identity that survives that.
Carried by:
No event carries this field yet.
B.7.11 destination.socket.token.service-sid #
- Type:
bin.sid - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The per-service SID of the token stamped on the destination endpoint's socket, when that token belongs to a service. It is found among the token's enabled groups and is always the 32-byte S-1-5-80 form. Absent for a socket that no service stands behind.
Carried by:
No event carries this field yet.
B.7.12 destination.socket.token.sid #
- Type:
bin.sid - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
The user SID of the token KACS stamped on the destination endpoint's
socket. It is the identity the socket was stamped with, not necessarily the
identity of whoever reads from it now. Present only when
destination.endpoint is program.
Carried by:
No event carries this field yet.
B.7.13 destination.stratum.flags #
- Type:
uint.flags - Values:
0x1 create·0x2 read-only·0x4 absent-may - Asserted: no
- Carried in: the payload
- Defined in:
stratafs.evman
The configuration flags of the stratum an object was written into, as the
mount option set them. Decoded as source.stratum.flags is. A copy-up
always writes into the stratum flagged create, so on a copy-up record
this field says nothing new; it matters where an object was written in
place.
Carried by:
No event carries this field yet.
B.7.14 destination.stratum.index #
- Type:
uint - Asserted: no
- Carried in: the payload
- Defined in:
stratafs.evman
Which stratum an object was written into, by index within the mount's stack.
Carried by:
B.7.15 destination.stratum.path #
- Type:
str.path - Asserted: no
- Carried in: the payload
- Defined in:
stratafs.evman
The filesystem path of the stratum an object was written into.
Carried by:
B.7.16 destination.token.guid #
- Type:
bin.guid - Asserted: no
- Carried in: the payload
- Defined in:
kernel.evman
The durable GUID of a token the operation created, which did not exist before it: the result of a duplicate, a filter or a token creation.
Carried by:
No event carries this field yet.
B.7.17 destination.unattributed #
- Type:
bool - Asserted: no
- Carried in: the payload
- Defined in:
ntfe.evman
Whether NTFE confessed that it could not attribute the destination endpoint
to a principal. When true, every rule condition on that endpoint's identity
was false for this traffic rather than evaluated. False does not prove
the endpoint was attributed: a program endpoint whose token could not
be read still reads false here.
Carried by:
No event carries this field yet.
Generated from kernel.evman, ntfe.evman, stratafs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.