[conntrack] Self-correcting mechanism for existing UDP connections' direction
Open
area/ebpf
area/flows
scope/M
type/fix
- Dominant language
- Go
- Stars
- 3.2k
- Forks
- 304
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 79
Description
Currently, for UDP connections that existed before Retina was deployed, conntrack uses a best-effort approach, relying on traffic direction based on the observation point. However, this method can be inaccurate. Implement a self-correcting mechanism in case the direction is incorrect. A possible solution could be using packet size and timing information to infer the direction of the connection.
FYI @nddq
Contributor guide
Assessment
This issue has not been assessed yet.