Skip to content

0.2.6 - Invalid conn sample bugfix
Compare
Choose a tag to compare
@ti-mo ti-mo released this 21 Apr 12:22
· 6 commits to master since this release
0.2.6
a18175c
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

This is an important bugfix, any users are highly encouraged to upgrade.

Previously, we were sampling events related to broadcasts and multicasts
that were never inserted into the conntrack table. Conntrack has
protocol-specific handlers that may give some flows an early drop if tracking
them doesn't make much sense.

These events are now dropped, since they were cause unbounded growth in the
internal bookkeeping BPF map. Another plus: the first packet of a flow no
longer has an empty start timestamp!

Changelog

a18175c Merge pull request #34 from ti-mo/drop-invalid-conn-samples
4e1e471 bpf - ignore samples for invalid flows (ct->status == 0)
09fca1d bpf - no longer expect the start timestamp of the first flow event to be zero
2898a56 bpf - update prebuilt ELF binaries

Assets 6
Loading