Additional Network Direction

Summary

While making all of the network.direction clarifications/corrections in our beats code both @leehinman and I noticed that we have one situation in which our allowed values doesn’t quite work out.

From the host-centric (ingress/egress) values: when you have traffic internal to a single host, i.e. loopback --> loopback or across interfaces on the same host, you have a case where you’re neither really ingress or egress. I propose adding one more value that’s used in the “host-centric” paradigm to describe traffic never leaving the host. Some possible names that came to mind are host or local.

[andrewstucki]

So, as far as beats go, whether someone events on local traffic or not is configurable. In Packetbeat at least you can even grab only local network traffic if you want, it’s all just a matter of what you decide to filter on, so I’m certain a good chunk of events today would be able to use this network direction association.

[dainperkins]

I’d actually lean towards something like intra-host that specifically delineates the scope…