sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-31 20:11:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixed an issue with how we track events that shouldn't be aggregated

Browse Source 
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
This commit is contained in:
Dmitri Dolguikh
2026-06-16 15:47:38 +02:00
parent a93cb66ea1
commit 7295e2e51f
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
client/internal/netflow/store/memory.go
View File

@@ -88,13 +88,14 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
for _, v := range am.events {
lookupKey := aggregationKey{srcAddr: v.SourceIP, destAddr: v.DestIP, destPort: v.DestPort, direction: int(v.Direction), protocol: uint8(v.Protocol), icmpType: v.ICMPType}
if _, ok := aggregated[lookupKey]; !ok {
aggregated[lookupKey] = v.Clone()
event := aggregated[lookupKey]
event := v.Clone()
if event.Protocol != types.ICMP && event.Protocol != types.ICMPv6 && event.Protocol != types.UDP && event.Protocol != types.TCP {
lookupKey.unique = time.Now().UnixNano() // to make the lookup key unique so we don't aggregate on it
aggregated[lookupKey] = event
continue
}
aggregated[lookupKey] = event
switch event.Type {
case types.TypeStart:
@@ -104,6 +105,10 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
case types.TypeEnd:
event.NumOfEnds += 1
}
if event.Protocol == types.ICMP || event.Protocol == types.ICMPv6 {
event.ICMPCode = 0 // reset icmp code
}
continue
}
@@ -130,7 +135,6 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
aggregatedEvent.ID = v.ID
aggregatedEvent.Type = v.Type
}
// do we aggregate icmp by code?
}
return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here