Dears, I discovered a bug in parsing device.ip while using odbc
collection. if the database is returning an IP and this IP is mapped to
saddr or daddr, then SA is mapping this ip to ip.src and device.ip,
which is wrong, should be only mapped to ip.sr...