Classify unidentified localhost connections as unidentified instead of unsolicited
This commit is contained in:
@@ -333,7 +333,7 @@ func NewConnectionFromFirstPacket(pkt packet.Packet) *Connection {
|
|||||||
proc, inbound, err := process.GetProcessByConnection(pkt.Ctx(), pkt.Info())
|
proc, inbound, err := process.GetProcessByConnection(pkt.Ctx(), pkt.Info())
|
||||||
if err != nil {
|
if err != nil {
|
||||||
log.Tracer(pkt.Ctx()).Debugf("network: failed to find process of packet %s: %s", pkt, err)
|
log.Tracer(pkt.Ctx()).Debugf("network: failed to find process of packet %s: %s", pkt, err)
|
||||||
if inbound {
|
if inbound && !netutils.ClassifyIP(pkt.Info().Dst).IsLocalhost() {
|
||||||
proc = process.GetUnsolicitedProcess(pkt.Ctx())
|
proc = process.GetUnsolicitedProcess(pkt.Ctx())
|
||||||
} else {
|
} else {
|
||||||
proc = process.GetUnidentifiedProcess(pkt.Ctx())
|
proc = process.GetUnidentifiedProcess(pkt.Ctx())
|
||||||
|
|||||||
Reference in New Issue
Block a user