Hey! We do a lot of network flow work. We have a sort of issue using "source" and "destination" because flow data comes in both directions and we get records for each. The data for a single session might look like:
| source.ip |
source.port |
destination.ip |
desatination.port |
| 1.2.3.4 |
54321 |
6.7.8.9 |
443 |
| 6.7.8.9 |
443 |
1.2.3.4 |
5432 |
So that's a problem for us. The concepts of source and destination really only apply on a packet scale anyway. We'd like to normalize both of the records into:
| client.ip |
client.port |
server.ip |
server.port |
| 1.2.3.4 |
54321 |
6.7.8.9 |
443 |
This would also sort through things like DNS requests and other services that open a port.
Thoughts about that?
Hey! We do a lot of network flow work. We have a sort of issue using "source" and "destination" because flow data comes in both directions and we get records for each. The data for a single session might look like:
So that's a problem for us. The concepts of source and destination really only apply on a packet scale anyway. We'd like to normalize both of the records into:
This would also sort through things like DNS requests and other services that open a port.
Thoughts about that?