Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend conntrack API to allow both splitted and unsplitted aggregation #280

Open
ronensc opened this issue Aug 3, 2022 · 1 comment
Open

Comments

@ronensc
Copy link
Collaborator

ronensc commented Aug 3, 2022

Currently, the configuration of an output field of a connection supports a boolean flag splitAB to control whether to split the aggregation by direction.

For example, the following configuration:

outputFields:
  - name: Bytes
	operation: sum
	splitAB: false

will add a single Bytes field to a connection which sums the bytes of flows from A to B and from B to A.

On the other hand, the following configuration

outputFields:
  - name: Bytes
	operation: sum
	splitAB: true

will add two fields (Bytes_AB and Bytes_BA) to the connection which sums the bytes separately for A->B and B->A respectively.

If we want to allow both splitted and unsplitted sums, and end up with 3 additional fields in the connection (Bytes, Bytes_AB and Bytes_AB), we need to write:

outputFields:
  - name: Bytes
	operation: sum
	splitAB: true
  - name: Bytes
	operation: sum
	splitAB: false

We need to think if we want to make the configuration more compact and clear.
Also, do we want to allow aggregation of only one direction but not the other?
If so, 2 options come to mind:

  1. Replace splitAB with 3 booleans:
outputFields:
  - name: Bytes
	operation: sum
	aggregateAB: true
	aggregateBA: true
	aggregateBoth: true
  1. Replace splitAB with a list:
outputFields:
  - name: Bytes
	operation: sum
	aggregateBy: [AB, BA, both]
@eranra
Copy link
Collaborator

eranra commented Aug 7, 2022

@ronensc can we go with an enum approach that for the emit field (instead of splitAB) supports the following "AB" (only split), "Totals" (only totals), "AB&Totlas" (that emits both the split values and the totals). I think that splitting just on one of the sides is not very reasonable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants