Review feedback

probe/endpoint/dns_snooper_linux_amd64.go

@@ -43,20 +43,11 @@ func NewDNSSnooper() (*DNSSnooper, error) {
 }
 
 func newPcapHandle() (*pcap.Handle, error) {
-	// TODO: use specific interfaces instead?
 	inactive, err := pcap.NewInactiveHandle("any")
 	if err != nil {
 		return nil, err
 	}
 	defer inactive.CleanUp()
-	if err = inactive.SetPromisc(true); err != nil {
-		return nil, err
-	}
-	// TODO: reduce the size of packets being copied? maybe an overoptimization
-	// if err = inactive.SetSnapLen(snaplen); err != nil {
-	//	return
-	// }
-
 	// pcap timeout blackmagic copied from Weave Net to reduce CPU consumption
 	// see https://github.com/weaveworks/weave/commit/025315363d5ea8b8265f1b3ea800f24df2be51a4
 	if err = inactive.SetTimeout(time.Duration(math.MaxInt64)); err != nil {
@@ -132,7 +123,7 @@ func (s *DNSSnooper) run() {
 		sll           layers.LinuxSLL
 	)
 
-	// assumes that the "any" interface in being used (see https://wiki.wireshark.org/SLL)
+	// assumes that the "any" interface is being used (see https://wiki.wireshark.org/SLL)
 	packetParser := gopacket.NewDecodingLayerParser(layers.LayerTypeLinuxSLL, &sll, &eth, &ip4, &ip6, &udp, &tcp, &dns)
 
 	for {

probe/endpoint/dns_snooper_others.go

@@ -0,0 +1,25 @@
+// +build darwin arm
+
+// Cross-compiling the snooper requires having pcap binaries,
+// let's disable it for now.
+// See http://stackoverflow.com/questions/31648793/go-programming-cross-compile-for-revel-framework
+
+package endpoint
+
+// DNSSnooper is a snopper of DNS queries
+type DNSSnooper struct{}
+
+// NewDNSSnooper creates a new snooper of DNS queries
+func NewDNSSnooper() (*DNSSnooper, error) {
+	return nil, nil
+}
+
+// CachedNamesForIP obtains the domains associated to an IP,
+// obtained while snooping A-record queries
+func (s *DNSSnooper) CachedNamesForIP(ip string) []string {
+	return []string{}
+}
+
+// Stop makes the snooper stop inspecting DNS communications
+func (s *DNSSnooper) Stop() {
+}

probe/endpoint/reporter.go

@@ -21,6 +21,7 @@ const (
 	Conntracked     = "conntracked"
 	Procspied       = "procspied"
 	ReverseDNSNames = "reverse_dns_names"
+	SnoopedDNSNames = "snooped_dns_names"
 )
 
 // Reporter generates Reports containing the Endpoint topology.
@@ -195,11 +196,10 @@ func (r *Reporter) makeEndpointNode(namespaceID string, addr string, port uint16
 	node := report.MakeNodeWith(
 		report.MakeEndpointNodeID(r.hostID, namespaceID, addr, portStr),
 		map[string]string{Addr: addr, Port: portStr})
-	names := r.dnsSnooper.CachedNamesForIP(addr)
-	if resolvedNames, err := r.reverseResolver.get(addr); err == nil {
-		names = append(names, resolvedNames...)
+	if names := r.dnsSnooper.CachedNamesForIP(addr); len(names) > 0 {
+		node = node.WithSet(SnoopedDNSNames, report.MakeStringSet(names...))
 	}
-	if len(names) > 0 {
+	if names, err := r.reverseResolver.get(addr); err == nil && len(names) > 0 {
 		node = node.WithSet(ReverseDNSNames, report.MakeStringSet(names...))
 	}
 	if extra != nil {