beats icon indicating copy to clipboard operation
beats copied to clipboard
verified publisher icon elastic

Optionally ignore MAC address in flow matching in Packetbeat

Open Tacklebox opened this issue 6 months ago • 4 comments

Proposed commit message

This adds a new configuration field under flows allow_mismatched_eth which if set to true, will not add the MAC address to the flowId. This allows correlating packets that for one reason or another end up with a differing return route. E.g. a DNS response is returned on a different interface or from a different source than the request was sent on/to.

This change is to support the enhancement request

Checklist

  • [x] My code follows the style guidelines of this project
  • [x] I have commented my code, particularly in hard-to-understand areas
  • [x] I have made corresponding changes to the documentation
  • [x] I have made corresponding change to the default configuration files
  • [ ] I have added tests that prove my fix is effective or that my feature works
  • [x] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

There should be none, as this is a default false configuration, so unless the field is added no behaviour in packetbeat changes.

Tacklebox avatar Jun 23 '25 14:06 Tacklebox

:robot: GitHub comments

Expand to view the GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

github-actions[bot] avatar Jun 23 '25 14:06 github-actions[bot]

This pull request does not have a backport label. If this is a bug or security fix, could you label this PR @Tacklebox? 🙏. For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed branches, such as:

  • backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

mergify[bot] avatar Jun 23 '25 14:06 mergify[bot]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

elasticmachine avatar Jun 23 '25 14:06 elasticmachine

This pull request is now in conflicts. Could you fix it? 🙏 To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mborden/AllowMismatchedEth upstream/mborden/AllowMismatchedEth
git merge upstream/main
git push upstream mborden/AllowMismatchedEth

mergify[bot] avatar Jun 23 '25 14:06 mergify[bot]

@Tacklebox are you still working on this? The linter is just complaining about the int -> uint conversion, seems like.

fearful-symmetry avatar Jul 25 '25 14:07 fearful-symmetry

Yea, I think that's just an update to gosec linter? It's suspiciously on something to do with flowID but It's not a line I changed and I don't immediately see how my change would have caused anything to behave differently there. I disabled the lint for that line

Tacklebox avatar Jul 25 '25 14:07 Tacklebox

@mergifyio backport 8.17 8.18 8.19 9.0 9.1

github-actions[bot] avatar Jul 28 '25 14:07 github-actions[bot]

backport 8.17 8.18 8.19 9.0 9.1

✅ Backports have been created

mergify[bot] avatar Jul 28 '25 14:07 mergify[bot]