test(packetparser): fix high aggregation perf sampling assertion

Author: holly-agyei

pkg/plugin/packetparser/packetparser_ebpf_test.go

@@ -869,7 +869,7 @@ func TestHighAggregationPreviouslyObserved(t *testing.T) {
 		"expected previously_observed_packets > 0 at HIGH aggregation")
 }
 
-func TestHighAggregationSamplingSuppressesPerfBufferEvents(t *testing.T) {
+func TestHighAggregationSamplingSuppressesRepeatedPerfBufferEvents(t *testing.T) {
 	objs, reader := compileAndLoadVariant(t, compileOpts{
 		bypassFilter:     1,
 		enableConntrack:  false,
@@ -891,6 +891,12 @@ func TestHighAggregationSamplingSuppressesPerfBufferEvents(t *testing.T) {
 		SrcIP: srcIP, DstIP: dstIP, SrcPort: 61000, DstPort: 80, ACK: true,
 	})
 	ebpftest.RunProgram(t, objs.EndpointIngressFilter, ackPkt)
+	_, ok := ebpftest.ReadPerfEvent[packetparserPacket](t, reader, perfReaderTimeout)
+	require.True(t, ok, "first ACK should still be reported when the connection has not emitted a prior sample")
+
+	// Once the ACK has established last_report for the connection, repeated
+	// ACKs should stay suppressed while sampling is forced off.
+	ebpftest.RunProgram(t, objs.EndpointIngressFilter, ackPkt)
 	ebpftest.AssertNoPerfEvent(t, reader, 100*time.Millisecond)
 }