Incorporating local-vs-external network vantage points

[ckreibich]

A given network flow's 5-tuple will differ depending on whether it's perceived internally, externally, before or after a NAT, etc. Can the Community ID accommodate this?

The short answer is no, since there's an assumption that the ID is based on the observed flow tuple, so presence of a NAT will make a semantically identical flow look like two different ones. However, this relates to #4 in that the ID could be based on other flow properties such as QUIC's connection ID.

This was a talk discussion question at SuriCon 2018.

[regit]

A possibility could be to generate a hash like (src_hash):(dst_hash). But the server side will not be random at all.

[ckreibich]

Yep! Keeping the endpoints separate also came up in #10. I'm not sure it adds much, though.