From 4d948a58880c1d352d82c122fa5866ae541a7ad1 Mon Sep 17 00:00:00 2001 From: Lorenzo Manacorda Date: Wed, 5 Oct 2016 13:35:22 +0200 Subject: [PATCH] use port number as better indicator of fake close [skip ci] --- probe/endpoint/reporter.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/probe/endpoint/reporter.go b/probe/endpoint/reporter.go index 78a94be3c..620443ad2 100644 --- a/probe/endpoint/reporter.go +++ b/probe/endpoint/reporter.go @@ -167,7 +167,7 @@ func (r *Reporter) Report() (report.Report, error) { r.addConnection(&rpt, tuple, "", fromNodeInfo, toNodeInfo) case Close: // ignore fake closes - if e.SourceAddress.String() != "0.0.0.0" && e.DestAddress.String() != "0.0.0.0" { + if e.SourcePort != 0 && e.DestPort != 0 { r.removeConnection(&rpt, tuple, "", fromNodeInfo, toNodeInfo) } }