Pachetbeat: not deterministic src/dst assignment

Elastic Stack Beats
1

Hi folks,

With NFS beat we have notice that some time client and server ip addresses are mixed up. My understanding is that roles are assigned when a first packet is seen btypacketbeat. If you are in the middle of then it may happen that reply from a client seen first. Is it know behavior or NFS beat is not handle it correct?

Thanks,
kofemann.

2

NFS beat? You mean packetbeat? The NFS protocol analyzer transactions or flows have 'wrong' src/dst order? I think NFS transactions (being based on some RPC) order depends by originator of particular RPC call. For flows it depends on first seen packet.

3

In the mean while, I have figured out. If you process request and dir in the Parse method is TspDirectionOriginal, then src and dst in correct order. Other wise you have to swap it. I was expected, that direction is always bound to the port number. But this is also ok, if you know about it :slight_smile: