Prevent packet bursting by skipping consecutive ones

If a process (using the same source port) keeps
transmitting packets, only insert a log at the end of
a time interval

1 files changed, 3 insertions, 1 deletions

diff --git a/lib/collect.c b/lib/collect.c
index 5ea673a..5f973be 100644
--- a/lib/collect.c
+++ b/lib/collect.c
@@ -42,7 +42,9 @@ Global g;
 static int handle_packet(__attribute__((unused)) struct nflog_g_handle *gh,
                          __attribute__((unused)) struct nfgenmsg *nfmsg,
                          struct nflog_data *nfa, void *_s) {
-#define HASH_ENTRY(e) (e->sport ^ e->timestamp)
+// log a bursting connection every `BURST_PERIOD` second
+#define BURST_PERIOD 0x4
+#define HASH_ENTRY(e) (e->sport ^ (e->timestamp & ~(BURST_PERIOD - 1)))
     register const struct iphdr *iph;
     register Entry *entry;
     const struct tcphdr *tcph;