接受似乎以客户端和服务器 IP/端口反转的事件

Describe the bug

Periodically we see a number of inbound accept events where the client and server IP and port in the connection tuple seem like they are the wrong way around and the static listener port (e.g., 443, 2040, 8081, 9090, 9091, etc.) is tracked as the client port (fd.cport) and the ephemeral range port is tracked as the server port (fd.sport).

Here's a dump of sysdig --modern-bpf -j 'evt.type in (accept,accept4,listen) and evt.dir=< and fd.sport>=32768' using the same bpf level as falco that seems to show these coming from the bpf driver: