Split unattributed connections into to Unidentified App and Network Noise

network/connection.go

@@ -317,7 +317,11 @@ func NewConnectionFromFirstPacket(pkt packet.Packet) *Connection {
 	proc, inbound, err := process.GetProcessByConnection(pkt.Ctx(), pkt.Info())
 	if err != nil {
 		log.Tracer(pkt.Ctx()).Debugf("network: failed to find process of packet %s: %s", pkt, err)
-		proc = process.GetUnidentifiedProcess(pkt.Ctx())
+		if inbound {
+			proc = process.GetUnsolicitedProcess(pkt.Ctx())
+		} else {
+			proc = process.GetUnidentifiedProcess(pkt.Ctx())
+		}
 	}
 
 	// Create the (remote) entity.

network/proc/findpid.go

@@ -23,7 +23,7 @@ func GetPID(socketInfo socket.Info) (pid int) {
 	currentPid := socketInfo.GetPID()
 
 	// If the current PID already is valid (ie. not unidentified), return it immediately.
-	if currentPid != socket.UnidentifiedProcessID {
+	if currentPid != socket.UndefinedProcessID {
 		return currentPid
 	}
 
@@ -91,7 +91,7 @@ func findPID(uid, inode int) (pid int) {
 		}
 	}
 
-	return socket.UnidentifiedProcessID
+	return socket.UndefinedProcessID
 }
 
 func findSocketFromPid(pid int, socketName string) bool {

network/proc/tables.go

@@ -149,7 +149,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
 					IP:   localIP,
 					Port: uint16(localPort),
 				},
-				PID:   socket.UnidentifiedProcessID,
+				PID:   socket.UndefinedProcessID,
 				UID:   int(uid),
 				Inode: int(inode),
 			})
@@ -164,7 +164,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
 						IP:   localIP,
 						Port: uint16(localPort),
 					},
-					PID:   socket.UnidentifiedProcessID,
+					PID:   socket.UndefinedProcessID,
 					UID:   int(uid),
 					Inode: int(inode),
 				})
@@ -191,7 +191,7 @@ func getTableFromSource(stack uint8, procFile string) (connections []*socket.Con
 						IP:   remoteIP,
 						Port: uint16(remotePort),
 					},
-					PID:   socket.UnidentifiedProcessID,
+					PID:   socket.UndefinedProcessID,
 					UID:   int(uid),
 					Inode: int(inode),
 				})

network/socket/socket.go

@@ -6,8 +6,10 @@ import (
 )
 
 const (
-	// UnidentifiedProcessID is originally defined in the process pkg, but duplicated here because of import loops.
+	// UndefinedProcessID signifies that the process ID is unknown.
-	UnidentifiedProcessID = -1
+	// It must match portmaster/process.UndefinedProcessID
+	// It is duplicated here because of import loops.
+	UndefinedProcessID = -1
 )
 
 // ConnectionInfo holds socket information returned by the system.

network/state/lookup.go

@@ -60,7 +60,7 @@ func Lookup(pktInfo *packet.Info, fast bool) (pid int, inbound bool, err error)
 		return udp6Table.lookup(pktInfo, fast)
 
 	default:
-		return socket.UnidentifiedProcessID, false, errors.New("unsupported protocol for finding process")
+		return socket.UndefinedProcessID, false, errors.New("unsupported protocol for finding process")
 	}
 }
 
@@ -108,7 +108,7 @@ func (table *tcpTable) lookup(pktInfo *packet.Info, fast bool) (
 		}
 	}
 
-	return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
+	return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
 }
 
 func (table *tcpTable) findSocket(pktInfo *packet.Info) (
@@ -201,7 +201,7 @@ func (table *udpTable) lookup(pktInfo *packet.Info, fast bool) (
 		}
 	}
 
-	return socket.UnidentifiedProcessID, pktInfo.Inbound, ErrConnectionNotFound
+	return socket.UndefinedProcessID, pktInfo.Inbound, ErrConnectionNotFound
 }
 
 func (table *udpTable) findSocket(pktInfo *packet.Info, isInboundMulticast bool) (socketInfo *socket.BindInfo) {

network/state/system_linux.go

@@ -18,7 +18,7 @@ func checkPID(socketInfo socket.Info, connInbound bool) (pid int, inbound bool,
 	for i := 0; i <= lookupRetries; i++ {
 		// look for PID
 		pid = proc.GetPID(socketInfo)
-		if pid != socket.UnidentifiedProcessID {
+		if pid != socket.UndefinedProcessID {
 			// if we found a PID, return
 			break
 		}

process/find.go

@@ -31,6 +31,15 @@ func GetProcessByConnection(ctx context.Context, pktInfo *packet.Info) (process
 		return nil, pktInfo.Inbound, err
 	}
 
+	// Fallback to special profiles if PID could not be found.
+	if pid == UndefinedProcessID {
+		if connInbound {
+			pid = UnsolicitedProcessID
+		} else {
+			pid = UnidentifiedProcessID
+		}
+	}
+
 	process, err = GetOrFindProcess(ctx, pid)
 	if err != nil {
 		log.Tracer(ctx).Debugf("process: failed to find (primary) process with PID: %s", err)

process/process.go

@@ -131,6 +131,8 @@ func loadProcess(ctx context.Context, pid int) (*Process, error) {
 	switch pid {
 	case UnidentifiedProcessID:
 		return GetUnidentifiedProcess(ctx), nil
+	case UnsolicitedProcessID:
+		return GetUnsolicitedProcess(ctx), nil
 	case SystemProcessID:
 		return GetSystemProcess(ctx), nil
 	}

process/profile.go

@@ -34,6 +34,8 @@ func (p *Process) GetProfile(ctx context.Context) (changed bool, err error) {
 	switch p.Pid {
 	case UnidentifiedProcessID:
 		profileID = profile.UnidentifiedProfileID
+	case UnsolicitedProcessID:
+		profileID = profile.UnsolicitedProfileID
 	case SystemProcessID:
 		profileID = profile.SystemProfileID
 	case ownPID:

process/special.go

@@ -8,29 +8,43 @@ import (
 	"golang.org/x/sync/singleflight"
 
 	"github.com/safing/portbase/log"
+	"github.com/safing/portmaster/profile"
 )
 
 const (
-	// UnidentifiedProcessID is the PID used for anything that could not be
-	// attributed to a PID for any reason.
-	UnidentifiedProcessID = -1
-
 	// UndefinedProcessID is not used by any (virtual) process and signifies that
 	// the PID is unset.
-	UndefinedProcessID = -2
+	UndefinedProcessID = -1
+
+	// UnidentifiedProcessID is the PID used for outgoing connections that could
+	// not be attributed to a PID for any reason.
+	UnidentifiedProcessID = -2
+
+	// UnsolicitedProcessID is the PID used for incoming connections that could
+	// not be attributed to a PID for any reason.
+	UnsolicitedProcessID = -3
 
 	// NetworkHostProcessID is the PID used for requests served to the network.
 	NetworkHostProcessID = -255
 )
 
 var (
-	// unidentifiedProcess is used when a process cannot be found.
+	// unidentifiedProcess is used for non-attributed outgoing connections.
 	unidentifiedProcess = &Process{
 		UserID:    UnidentifiedProcessID,
 		UserName:  "Unknown",
 		Pid:       UnidentifiedProcessID,
 		ParentPid: UnidentifiedProcessID,
-		Name:      "Unidentified Processes",
+		Name:      profile.UnidentifiedProfileName,
+	}
+
+	// unsolicitedProcess is used for non-attributed incoming connections.
+	unsolicitedProcess = &Process{
+		UserID:    UnsolicitedProcessID,
+		UserName:  "Unknown",
+		Pid:       UnsolicitedProcessID,
+		ParentPid: UnsolicitedProcessID,
+		Name:      profile.UnsolicitedProfileName,
 	}
 
 	// systemProcess is used to represent the Kernel.
@@ -39,17 +53,22 @@ var (
 		UserName:  "Kernel",
 		Pid:       SystemProcessID,
 		ParentPid: SystemProcessID,
-		Name:      "Operating System",
+		Name:      profile.SystemProfileName,
 	}
 
 	getSpecialProcessSingleInflight singleflight.Group
 )
 
-// GetUnidentifiedProcess returns the special process assigned to unidentified processes.
+// GetUnidentifiedProcess returns the special process assigned to non-attributed outgoing connections.
 func GetUnidentifiedProcess(ctx context.Context) *Process {
 	return getSpecialProcess(ctx, unidentifiedProcess)
 }
 
+// GetUnsolicitedProcess returns the special process assigned to non-attributed incoming connections.
+func GetUnsolicitedProcess(ctx context.Context) *Process {
+	return getSpecialProcess(ctx, unsolicitedProcess)
+}
+
 // GetSystemProcess returns the special process used for the Kernel.
 func GetSystemProcess(ctx context.Context) *Process {
 	return getSpecialProcess(ctx, systemProcess)

profile/special.go

@@ -10,13 +10,26 @@ const (
 	// UnidentifiedProfileID is the profile ID used for unidentified processes.
 	UnidentifiedProfileID = "_unidentified"
 	// UnidentifiedProfileName is the name used for unidentified processes.
-	UnidentifiedProfileName = "Unidentified Processes"
+	UnidentifiedProfileName = "Unidentified App"
 	// UnidentifiedProfileDescription is the description used for unidentified processes.
-	UnidentifiedProfileDescription = `This is not a real application, but a collection of connections that could not be attributed to a process. This could be because the Portmaster failed to identify the process, or simply because there is no process waiting for an incoming connection.
+	UnidentifiedProfileDescription = `Connections that could not be attributed to a specific app.
 
-Seeing a lot of incoming connections here is normal, as this resembles the network chatter of other devices.
+The Portmaster attributes connections (only TCP/UDP) to specific apps. When attribution for a connection fails, it ends up here.
+
+Connections from unsupported protocols (like ICMP/"ping") are always collected here.
 `
 
+	// UnsolicitedProfileID is the profile ID used for unsolicited connections.
+	UnsolicitedProfileID = "_unsolicited"
+	// UnsolicitedProfileName is the name used for unsolicited connections.
+	UnsolicitedProfileName = "Network Noise"
+	// UnsolicitedProfileDescription is the description used for unsolicited connections.
+	UnsolicitedProfileDescription = `Common connections coming from your Local Area Network.
+
+Local Area Networks usually have quite a lot of traffic from applications that are trying to find things on the network. This might be a computer trying to find a printer, or a file sharing application searching for local peers. These network packets will automatically arrive at your device.
+
+These connections - the "network noise" - can be found in this app.`
+
 	// SystemProfileID is the profile ID used for the system/kernel.
 	SystemProfileID = "_system"
 	// SystemProfileName is the name used for the system/kernel.
@@ -68,6 +81,9 @@ func updateSpecialProfileMetadata(profile *Profile, binaryPath string) (ok, chan
 	case UnidentifiedProfileID:
 		newProfileName = UnidentifiedProfileName
 		newDescription = UnidentifiedProfileDescription
+	case UnsolicitedProfileID:
+		newProfileName = UnsolicitedProfileName
+		newDescription = UnsolicitedProfileDescription
 	case SystemProfileID:
 		newProfileName = SystemProfileName
 		newDescription = SystemProfileDescription