From 7295e2e51f6b217935dd2384a92a72a57e76a716 Mon Sep 17 00:00:00 2001 From: Dmitri Dolguikh Date: Tue, 16 Jun 2026 15:47:38 +0200 Subject: [PATCH] fixed an issue with how we track events that shouldn't be aggregated Signed-off-by: Dmitri Dolguikh --- client/internal/netflow/store/memory.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/client/internal/netflow/store/memory.go b/client/internal/netflow/store/memory.go index 9cc5edd23..d7e06e8c3 100644 --- a/client/internal/netflow/store/memory.go +++ b/client/internal/netflow/store/memory.go @@ -88,13 +88,14 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event { for _, v := range am.events { lookupKey := aggregationKey{srcAddr: v.SourceIP, destAddr: v.DestIP, destPort: v.DestPort, direction: int(v.Direction), protocol: uint8(v.Protocol), icmpType: v.ICMPType} if _, ok := aggregated[lookupKey]; !ok { - aggregated[lookupKey] = v.Clone() - event := aggregated[lookupKey] + event := v.Clone() if event.Protocol != types.ICMP && event.Protocol != types.ICMPv6 && event.Protocol != types.UDP && event.Protocol != types.TCP { lookupKey.unique = time.Now().UnixNano() // to make the lookup key unique so we don't aggregate on it + aggregated[lookupKey] = event continue } + aggregated[lookupKey] = event switch event.Type { case types.TypeStart: @@ -104,6 +105,10 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event { case types.TypeEnd: event.NumOfEnds += 1 } + + if event.Protocol == types.ICMP || event.Protocol == types.ICMPv6 { + event.ICMPCode = 0 // reset icmp code + } continue } @@ -130,7 +135,6 @@ func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event { aggregatedEvent.ID = v.ID aggregatedEvent.Type = v.Type } - // do we aggregate icmp by code? } return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here