NETOBSERV-1240 DNS flows can be missed with Duplicates "unselected" by default in UI #173
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
it doesn't looks good, as we would end up with multiple duplicates showing "Duplicate=false" |
| fwd := make([]*Record, 0, len(records)) | ||
| for _, record := range records { | ||
| if cache.isDupe((*ebpf.BpfFlowId)(&record.Id)) { | ||
| if record.Metrics.DnsRecord.Id == 0 && cache.isDupe((*ebpf.BpfFlowId)(&record.Id)) { |
There was a problem hiding this comment.
an option we mentioned with @msherif1234 was also adding some logic:
Set it as duplicate IF:
(dnsId unset AND cache.isDupe)
OR
(ndsId unset AND DNS-tracker-feature enabled AND Source-port is dns port)
This assumes every response from a DNS port is duplicated anyway by the dns tracker so we can mark all of them as duplicates, except the one holding the DNS info.
That wouldn't be a perfect solution, it has some risks; e.g. if for any reason the DNS tracker doesn't work then all DNS flows would be marked duplicates. I think we should still try to find better .... but that could be "good enough" if we don't find better
|
Closing this in favor of alternative PR |
This PR skip
dedupeon DNS flows.To avoid having the request and response showing the same Direction when service is involved, we should fix the related case:
netobserv/flowlogs-pipeline#483 (comment)