GitLab

Also backup database ASAP, when flows are moved (it used to be done in
cron,after the archive script finished - which could be long).

flows are either inserted+deleted, or nothing is changed

0x20 bit encoding makes DNS queries with random mixed case

read directly from suricata socket

also try (!again!) to ensure that suricata_conntrack_flows script dies
with pakon-monitor.py. Trying bigger hammer (PR_SET_PDEATHSIG) this time...

monitor should get complete information about bypassed flows from
suricata_conntrack script before its exit - so they are complete.
What remains are connections that were just opened - we don't know much about
them, they just make output more confusing.

src_ip doesn't work well with IPv6 (dns could still go over IPv4)
also, temporary IPv6 addresses are used, with short lifetime
MAC is much more stable identifier