From 2be26e2be421463d34d8cd68bd11aa09738711c6 Mon Sep 17 00:00:00 2001 From: Alfonso Acosta Date: Tue, 10 Jan 2017 15:35:32 +0000 Subject: [PATCH] Limit connections to established and half-closed --- probe/endpoint/procspy/procnet.go | 11 +++++++++-- probe/endpoint/procspy/spy.go | 8 ++++++++ 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/probe/endpoint/procspy/procnet.go b/probe/endpoint/procspy/procnet.go index 1946d5f6a..3073ad2c3 100644 --- a/probe/endpoint/procspy/procnet.go +++ b/probe/endpoint/procspy/procnet.go @@ -35,7 +35,7 @@ again: b := p.b var ( - sl, local, remote, inode []byte + sl, local, remote, state, inode []byte ) sl, b = nextField(b) // 'sl' column @@ -46,7 +46,14 @@ again: } local, b = nextField(b) remote, b = nextField(b) - _, b = nextField(b) // 'st' column + state, b = nextField(b) + switch parseHex(state) { + // Only process established or half-closed connections + case tcpEstablished, tcpFinWait1, tcpFinWait2, tcpCloseWait: + default: + p.b = nextLine(b) + goto again + } _, b = nextField(b) // 'tx_queue' column _, b = nextField(b) // 'rx_queue' column _, b = nextField(b) // 'tr' column diff --git a/probe/endpoint/procspy/spy.go b/probe/endpoint/procspy/spy.go index b506d587d..7620e208a 100644 --- a/probe/endpoint/procspy/spy.go +++ b/probe/endpoint/procspy/spy.go @@ -7,6 +7,14 @@ import ( "net" ) +const ( + // according to /include/net/tcp_states.h + tcpEstablished = 1 + tcpFinWait1 = 4 + tcpFinWait2 = 5 + tcpCloseWait = 8 +) + // Connection is a (TCP) connection. The Proc struct might not be filled in. type Connection struct { Transport string