From 2767e2b319a13f23b3146208a14aa25e8d3c352a Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Tue, 8 Oct 2019 07:49:17 +0000
Subject: [PATCH] improvement: only record connections that we have a PID for

---
 probe/endpoint/ebpf.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/probe/endpoint/ebpf.go b/probe/endpoint/ebpf.go
index 254ee39eb..b35674cd1 100644
--- a/probe/endpoint/ebpf.go
+++ b/probe/endpoint/ebpf.go
@@ -323,6 +323,9 @@ func (t *EbpfTracker) walkConnections(f func(ebpfConnection)) {
 func (t *EbpfTracker) feedInitialConnections(conns procspy.ConnIter, seenTuples map[string]fourTuple, processesWaitingInAccept []int, hostNodeID string) {
 	t.Lock()
 	for conn := conns.Next(); conn != nil; conn = conns.Next() {
+		if conn.Proc.PID == 0 {
+			continue // no point in tracking a connection which we can't associate to a process
+		}
 		tuple, namespaceID, incoming := connectionTuple(conn, seenTuples)
 		if _, ok := t.closedDuringInit[tuple]; !ok {
 			if _, ok := t.openConnections[tuple]; !ok {