elastic / elastic/beats

Add an option to ignore MAC addresses when other layer data could correlate a flow successfully.

Open
#43,899 2 comments 0 reactions 0 assignees View on GitHub
needs_team Stalled
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

**Describe the enhancement:**
If higher level data like IP addresses are available to match a flow, but the MAC addresses don't match, there should be an option to relax the requirement for the MACs to match in order to record the flow.

**Describe a specific use case for the enhancement or feature:**
For example when aggregating multiple links/interfaces, packets can have a different return route. In that situation, having the ability to ignore the MAC addresses would allow the flows to be constructed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.