handle socket close

probe/endpoint/reporter.go

@@ -171,8 +171,15 @@ func (r *Reporter) Report() (report.Report, error) {
 					log.Infof("Accept! pid:(%v), src-addr: %v,src-port: %v, dst-addr: %v, dst-port: %v", e.Pid, e.SourceAddress, e.SourcePort, e.DestAddress, e.DestPort)
 				}
 				r.addConnection(&rpt, tuple, "", fromNodeInfo, toNodeInfo)
+			case Close:
+				// ignore fake closes
+				if e.SourceAddress.String() != "0.0.0.0" && e.DestAddress.String() != "0.0.0.0" {
+					if e.SourcePort == 9999 || e.DestPort == 9999 {
+						log.Infof("Close! pid:(%v), src-addr: %v,src-port: %v, dst-addr: %v, dst-port: %v", e.Pid, e.SourceAddress, e.SourcePort, e.DestAddress, e.DestPort)
+					}
+					r.removeConnection(&rpt, tuple, "", fromNodeInfo, toNodeInfo)
+				}
 			}
-
 		})
 	}
 
@@ -228,6 +235,17 @@ func (r *Reporter) addConnection(rpt *report.Report, t fourTuple, namespaceID st
 	rpt.Endpoint = rpt.Endpoint.AddNode(toNode)
 }
 
+func (r *Reporter) removeConnection(rpt *report.Report, t fourTuple, namespaceID string, extraFromNode, extraToNode map[string]string) {
+	// create node from tuple
+	var (
+		fromNode = r.makeEndpointNode(namespaceID, t.fromAddr, t.fromPort, extraFromNode)
+		toNode   = r.makeEndpointNode(namespaceID, t.toAddr, t.toPort, extraToNode)
+	)
+	// check
+	rpt.Endpoint.RemoveNode(fromNode)
+	rpt.Endpoint.RemoveNode(toNode)
+}
+
 func (r *Reporter) makeEndpointNode(namespaceID string, addr string, port uint16, extra map[string]string) report.Node {
 	portStr := strconv.Itoa(int(port))
 	node := report.MakeNodeWith(

report/topology.go

@@ -114,6 +114,12 @@ func (t Topology) AddNode(node Node) Topology {
 	return t
 }
 
+func (t Topology) RemoveNode(node Node) Topology {
+	delete(t.Nodes, node.ID)
+
+	return t
+}
+
 // GetShape returns the current topology shape, or the default if there isn't one.
 func (t Topology) GetShape() string {
 	if t.Shape == "" {