Observing Traffic

What the Observer Records

The observer finds out which of a host's connections are post-quantum. The host copies the start of every flow on its interfaces to anchord, which reads each handshake. For each service the host connects to, serves or forwards, the observer records:

• The protocol the flow used, such as TLS.
• Whether its key exchange was post-quantum, hybrid, classical or absent.
• Which side prevented post-quantum key exchange, if it was not post-quantum.
• The process on the host that owns the flow.

The observer reads a copy of each handshake, never the traffic itself. Traffic doesn't pass through it, so it can't slow, break or reroute a connection. It doesn't join a realm, so nothing is enrolled and no credential is needed.

While a flow lasts, the observer makes a record of it every minute, and one more when it ends. Each record goes to the daemon's inventory, and also to a collector if you set one.

The boot service gives anchord this access each time it starts, so you don't need to set anything up first.

Observing a Host

To inventory a host that doesn't join the overlay, run conflux observe. It starts the observer without an anchor, and the boot service starts it again after every reboot.

• sudo conflux status shows observe on its mode row, and an observer row with packets taken.
• sudo conflux inventory lists the services the host reached, each with its key exchange.

Observing doesn't erase the machine's other settings. If the machine ran an anchor before, its identity, taints and address are kept for the next time you run up or proxy.

On a machine that runs an anchor

If the machine runs an anchor, conflux observe stops it, and the machine leaves its realm. At a terminal, conflux asks you to confirm first. In a script, pass --yes; without it, conflux refuses and changes nothing. To keep the anchor and observe next to it, see Observing Beside an Anchor.

Observing Beside an Anchor

To inventory a machine that also runs an anchor, add --observe to up or proxy. The observer runs in the same daemon, and the machine stays in its realm:

$ sudo conflux up --observe
$ sudo conflux proxy 8080=127.0.0.1:3000 --observe

Next to an anchor, the observer records traffic from two sources, and each record says which source it came from:

• interfaces is the traffic on the host's interfaces, including the anchor's own connections to its peers.
• overlay is the traffic the anchor carries over the overlay between this machine and a peer. Each record names the peer and the relays the traffic passed through.

The overlay source also works in proxy mode, so a conflux proxy machine is inventoried as fully as a conflux up machine.

The observer starts before the anchor, because it doesn't need a credential. If the anchor can't start yet, the observer and its inventory keep running while the service tries again.

Choosing What to Record

Each observer option has one name on conflux observe and another on up and proxy:

Each command sets the observer exactly as its options say. Any option you leave out is turned off, so --observe-loopback on its own turns --observe-hide-names off. A command with no observer options leaves the observer as it is. On up and proxy, every observer option also implies --observe:

$ sudo conflux proxy 8080=127.0.0.1:3000 --observe-hide-names --export collector.example:4317

Reading the Inventory

The inventory summarises the records made since the daemon started. It has one entry for each service, broken down by protocol, key exchange, TLS version and cipher suite, and owning process. The inventory is held in memory, so it starts again whenever the daemon restarts.

To print the inventory as a table, run:

$ sudo conflux inventory

To save it as a CycloneDX 1.6 cryptography bill of materials (CBOM), run:

$ sudo conflux inventory -cbom > host.cdx.json

inventory is an anchorctl command that conflux passes straight through. If it prints nothing observed, no flow has ended or lasted a minute yet, so wait a minute and try again.

Exporting the Records

To keep every record, send each one to a collector as it is made. The collector can be the guardian or any OpenTelemetry collector that accepts OTLP over gRPC. Give its address with --export:

$ sudo conflux observe --export collector.example:4317

Starting.

  observer     af_packet, 0 flows held, 0 packets taken
  records      each sent to collector.example:4317 as it is made, and kept in the inventory
  service      active (systemd: conflux.service, enabled at boot)
  anchord      conflux, with CAP_NET_RAW to copy what the host's interfaces carry, for the observer

--export turns on the export block in conflux.json, sets its endpoint and turns on the flows and metrics signals. Any other settings in the block stay as they are. Each record arrives as an anchor.observed_flow event. With metrics on, the observer also sends its own counters: flows by protocol and key exchange, flows held, and packet copies the capture lost.

• For a collector without TLS, add --export-insecure.
• Headers can carry credentials, so you can't pass them on the command line. If the collector needs headers, set them in the export block. See The export Block.
• To send the records to the guardian, give its collector address. To read them there, see PQC Inventory.

Checking the Observer

To check the observer, run sudo conflux status. On a machine that only observes, the mode row says so, and the anchor's rows are left out:

  mode         observe — this host's traffic inventoried; no anchor, no realm
  …
  observer     af_packet, 12 flows held, 3480 packets taken
               loopback included, names hidden
  records      each sent to collector.example:4317 as it is made, and kept in the inventory
  anchord      conflux, with CAP_NET_RAW to copy what the host's interfaces carry, for the observer

The observer rows mean the following:

For more detail, run sudo conflux anchorctl observe. It reports on the running observer, including how many packet copies the capture dropped while the host was busy.

Stopping the Observer

Choose how to stop the observer:

On a proxy machine, run conflux proxy with all its specs and --no-observe.

Next Steps