Track (flow) conversations by application instead of src/dst port
Description
When doing flow processing we currently track conversation by the (location, protocol, host1, port1, host2, port2) tuple, where these hosts and ports are ordered in such a way that flows going in both directions use the same key.
This ends up effectivly tracking TCP (or UDP) sessions, which are relatively short lived. We would like to the modify the tracking to use the tagged application instead of the ports, resulting in a tuple like (location, protocol, host1, host2, application) instead.
This will also require updates to the Helm plugin.
When viewing conversations in the flow deep dive tool (Grafana + Helm), the series graph panel should use the following format for label: 10.0.0.1 <-> 10.0.0.2 [HTTP] (In) 10.0.0.1 <-> 10.0.0.2 [HTTP] (Out)
The table panel should have the following columns: Source IP, Dest. IP, Application, In, Out
When doing flow processing we currently track conversation by the
(location, protocol, host1, port1, host2, port2)tuple, where these hosts and ports are ordered in such a way that flows going in both directions use the same key.This ends up effectivly tracking TCP (or UDP) sessions, which are relatively short lived. We would like to the modify the tracking to use the tagged application instead of the ports, resulting in a tuple like
(location, protocol, host1, host2, application)instead.