Matthias Radestock 20138b9218 don't exclude NATed connections in mapping to processes ...

We used to ignore source endpoints that are associated with multiple
destination endpoints, which is a partial workaround for our inability
to correctly represent two connections from the same source ip/port
but different processes, or the same destination ip/port but different
processes. See #2665.

However, that condition is too coarse. In particular, we end up
ignoring endpoints that are connected to NATed destinations, since the
latter are represented by two (or more) endpoints.

The change here corrects that.

2017-12-15 11:40:43 +00:00

5.3 KiB

Raw Permalink Blame History

View Raw