Data augmentation option assessment

[fako1024]

In the past, several suggestions have been made by various sources how the available data could be augmented to improve the value goProbe provides even more.

Important:

• Any modification must NOT affect performance in any significant way to keep up with the high standards established by us.
• Only backwards-compatible changes (or changes that are optional and can be handled with versioning headers) will be accepted (as in: no DB format conversion / breaking changes)

Ideas:

• [ ] Store the first (/last) exact timestamp a flow was seen (maybe in an adjacent data structure so that it doesn't affect the main table)
• [ ] Store IP address of capturing interface in block metadata and hence allow additional filtering for "local" traffic (e.g. traffic originating from / destined for the host). Requires new block metadata version (but should be quite easy to do and handle at query time, in particular using global-query as it would required no extensions on that level).
• [x] #296
• [x] ~Bonus: Maybe remove the tracking for invalid IPv4 / IPv6 packets, because technically that's not even possible due to the pre-filtering~ (note: kept this in case we hit a scenario with custom BPF filters or similar that breaks the aforementioned guarantee)

[els0r]

Fully onboard, as long as we stay backwards compatible.

[fako1024]

Fully onboard, as long as we stay backwards compatible.

Absolutely, was so obvious that I forgot to add it to the "Important" area above. Amended... :stuck_out_tongue: