From c732fee4338fc580330629072c0effb74ccf1e21 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Wed, 14 Nov 2018 09:56:38 +0000 Subject: [PATCH] Don't add closed connections to 'activeFlows' --- probe/endpoint/conntrack.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/probe/endpoint/conntrack.go b/probe/endpoint/conntrack.go index b20ffacda..155dfa41c 100644 --- a/probe/endpoint/conntrack.go +++ b/probe/endpoint/conntrack.go @@ -17,6 +17,7 @@ const ( // From https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt eventsPath = "sys/net/netfilter/nf_conntrack_events" timeWait = "TIME_WAIT" + tcpClose = "CLOSE" tcpProto = 6 ) @@ -122,7 +123,7 @@ func (c *conntrackWalker) run() { } c.Lock() for _, flow := range existingFlows { - if c.relevant(flow) && flow.TCPState != timeWait { + if c.relevant(flow) && flow.TCPState != tcpClose && flow.TCPState != timeWait { c.activeFlows[flow.CtId] = flow } }