CF PCAP

[maxmoehl]

• Read the Contributing document.

Summary

This is the implementation of RFC 0048 / #1076.

In its current state the PR cannot be merged (and will be a draft PR for now) as there are two hacks left which have to be cleaned up:

1. I've just checked-in the libpcap release source code from the release tar-ball. I'd prefer to add libpcap as a submodule and consume that as it's also easy to bump but the autogen.sh was causing issues down the line. Either we add the libpcap release tar-ball as a blob or fix the autogen.
2. The archiver needs to support xattrs, this is a minor change that just needs to be upstreamed and then dropped from this PR.

The PR can be built into a release and deployed. To test the feature you can SSH into an app that was deployed after the change has been deployed and then observe traffic like this:

/tmp/lifecycle/cf-pcap -interface lo -filter "port 8080" | tcpdump -r - -X

This will print the HTTP traffic to the app process in plain-text to your terminal (while being safely escaped by tcpdump which is not the case for raw output from cf-pcap).

I'm looking for some early feedback on the changes so feel free to leave a review!

Backward Compatibility

Breaking Change? No

Disclaimer: The development of this PR was supported by Claude Code.