How to distinguish between local ip and remote ip from socket ?

[tanrenxuan]

When I use sysdig to output some log related to network, I can't find the remote Ip from fd(socket) field. For example：

fd fd.lip fd.rip fd.lport fd.rport 10.10.0.67:51252->10.10.0.114:8080 10.10.0.114 10.10.0.67 8080 51252 10.10.0.67:51252->10.10.0.114:8080 10.10.0.114 10.10.0.67 8080 51252 10.10.0.67:51252->10.10.0.114:8080 10.10.0.114 10.10.0.67 8080 51252 10.10.0.67:51252->10.10.0.114:8080 27065 10.10.0.114 10.10.0.67 8080 51252 10.10.0.114:60986->10.102.100.24:8888 27084 10.102.100.24 10.10.0.114 8888 60986 10.10.0.114:60986->10.102.100.24:8888 27084 10.102.100.24 10.10.0.114 8888 60986

I use sysdig to record some fields in server 10.10.0.114, however, sometimes fd.lip records 10.10.0.114, and sometimes it records a different ip, which confused me.

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.