CF PCAP

[maxmoehl]

• Read the Contributing document.

Summary

This is the implementation of RFC 0048 / #1076.

In its current state the PR cannot be merged (and will be a draft PR for now) as there are two hacks left which have to be cleaned up:

1. I've just checked-in the libpcap release source code from the release tar-ball. I'd prefer to add libpcap as a submodule and consume that as it's also easy to bump but the autogen.sh was causing issues down the line. Either we add the libpcap release tar-ball as a blob or fix the autogen.
2. The archiver needs to support xattrs, this is a minor change that just needs to be upstreamed and then dropped from this PR.

The PR can be built into a release and deployed. To test the feature you can SSH into an app that was deployed after the change has been deployed and then observe traffic like this:

/tmp/lifecycle/cf-pcap -interface lo -filter "port 8080" | tcpdump -r - -X

This will print the HTTP traffic to the app process in plain-text to your terminal (while being safely escaped by tcpdump which is not the case for raw output from cf-pcap).

I'm looking for some early feedback on the changes so feel free to leave a review!

Backward Compatibility

Breaking Change? No

Disclaimer: The development of this PR was supported by Claude Code.

[maxmoehl]

cloudfoundry/archiver#74 got merged and consumed in diego-release, dropped the commit and force-pushed. Now I only need to fix the BOSH blob.

[ameowlia]

@maxmoehl , @geofffranks, and I chatted in a zoom. The outcome was...

• make it optional
• adds docs
• ass testing (in cats?)
• get blob uploaded (ci link)
• split the commits so the vendor is in its own commit

[maxmoehl]

• make it optional

done and done

• adds docs

added to docs/

• ass testing (in cats?)

Depends on this being merged.

• get blob uploaded (ci link)

Draft PR opened

• split the commits so the vendor is in its own commit

deps and code

[maxmoehl]

I've adjusted the code to use the libpcap from the bosh blob and rebased on the latest develop. Next, I'll borrow an environment to throw this on to test it all together one more time.