Add an option to ignore MAC addresses when other layer data could correlate a flow successfully.
Open
needs_team
Stalled
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
**Describe the enhancement:**
If higher level data like IP addresses are available to match a flow, but the MAC addresses don't match, there should be an option to relax the requirement for the MACs to match in order to record the flow.
**Describe a specific use case for the enhancement or feature:**
For example when aggregating multiple links/interfaces, packets can have a different return route. In that situation, having the ability to ignore the MAC addresses would allow the flows to be constructed.
Contributor guide
Assessment
This issue has not been assessed yet.