Use the correct MAC for inventory items

inverse-inc · Sep 20, 2024 · 7344c24 · 7344c24
1 parent 74b3f75
commit 7344c24
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/go/cron/pfflow.go b/go/cron/pfflow.go
@@ -168,10 +168,18 @@ func (f *PfFlow) ToNetworkEvent() *NetworkEvent {
 }
 
 func (f *PfFlow) DestInventoryitem() *InventoryItem {
+	if f.BiFlow == 2 {
+		return macToInventoryitem(f.SrcMac)
+	}
+
 	return macToInventoryitem(f.DstMac)
 }
 
 func (f *PfFlow) SourceInventoryitem() *InventoryItem {
+	if f.BiFlow == 2 {
+		return macToInventoryitem(f.DstMac)
+	}
+
 	return macToInventoryitem(f.SrcMac)
 }