Allow selecting flows' direction

[mariomac]

Addresses issue 57 #57

To select the direction of the flows, set the DIRECTION env var to ingress, egress or both (default)

[codecov-commenter]

Codecov Report

Merging #58 (e23a233) into main (24af5a5) will decrease coverage by 0.86%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main      #58      +/-   ##
==========================================
- Coverage   34.76%   33.90%   -0.87%     
==========================================
  Files          19       19              
  Lines        1300     1333      +33     
==========================================
  Hits          452      452              
- Misses        829      862      +33     
  Partials       19       19              

Flag	Coverage Δ
unittests	33.90% <0.00%> (-0.87%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/agent/agent.go	13.84% <0.00%> (-1.08%)	⬇️
pkg/ebpf/tracer.go	3.28% <0.00%> (-0.22%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[joewilliams]

This seems to work like I would expect. Using ingress I only see incoming packets.

ipv4: 16:55:34.695398 enp0s3 IP 10.0.2.2:60317 > 10.0.2.15:22: protocol:tcp dir:0 bytes:1296 packets:18 ends: 16:55:36.723346
ipv4: 16:55:31.849440 enp0s3 IP 10.0.2.2:60313 > 10.0.2.15:22: protocol:tcp dir:0 bytes:108 packets:2 ends: 16:55:31.849499
ipv4: 16:55:39.754360 enp0s3 IP 1.1.1.1:53 > 10.0.2.15:46925: protocol:udp dir:0 bytes:97 packets:1 ends: 16:55:39.754360
ipv4: 16:55:40.500973 enp0s3 IP 1.1.1.1:53 > 10.0.2.15:60351: protocol:udp dir:0 bytes:97 packets:1 ends: 16:55:40.500973
ipv4: 16:55:36.853702 enp0s3 IP 10.0.2.2:60313 > 10.0.2.15:22: protocol:tcp dir:0 bytes:54 packets:1 ends: 16:55:36.853702
ipv4: 16:55:41.540880 enp0s3 IP 1.1.1.1:53 > 10.0.2.15:53554: protocol:udp dir:0 bytes:97 packets:1 ends: 16:55:41.540880
ipv4: 16:55:41.095818 enp0s3 IP 1.1.1.1:53 > 10.0.2.15:37621: protocol:udp dir:0 bytes:97 packets:1 ends: 16:55:41.095818

Thank you!

[jotak]

LGTM
and thanks @joewilliams for this suggestion.
@mariomac maybe that's a setting we could also expose in the operator, as it's also a way to reduce resource usage and stlll capturing most of the traffic. To be honest, in the console, I almost never change the "reporter" setting, which is set to "destination" by default, ie. it shows only ingress captured flows by default.