[bug query] duplication mac address in hosts metadata - concern?

Elastic Stack Beats
1

Hi,

While working through the creating a beat tutorial I noticed that mac addresses may be duplicated in the hosts metadata on linux. This occurs for virbr interfaces due to virtual bridges generating two interfaces, sharing the same hardware address.

$ ip addr show | grep -A1 ': virb'
4: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:bf:91:c4 brd ff:ff:ff:ff:ff:ff
--
5: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:bf:91:c4 brd ff:ff:ff:ff:ff:ff

The function that collates network interface info, util.GetNetInfo, assumes that addresses are unique or is not concerned whether they are.

This shows up as so

  "host": {
<snip>
    "containerized": false,
    "ip": [
<snip>
    ],
    "mac": [
<snip>
      "52:54:00:bf:91:c4",
      "52:54:00:bf:91:c4",
<snip>
    ],

My question is whether this is a concern worth fixing (the fix is trivial and I'm happy to send a PR for it) or whether it's both infrequent enough (only hosts with virtual bridges will see it) and innocuous enough to not bother with.

thanks

2

I'd say it's not a bad thing to fix. There's no reason to have duplicated values.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.