- keep a topology map in elasticsearch with all public IPs that each agent has
- at startup, each agent adds its IPs to the topology map (in elasticsearch under packetbeat-topology index)
- determine src_server and dst_server for each transaction
- ignore duplicated transactions