flowscope 0.10.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

//! Log every HTTP request and response observed on a pcap file.
//!
//! Demonstrates the PcapFlowSource + FlowSessionDriver + HttpParser
//! pipeline (typed-stream API).
//!
//! Usage:
//!     cargo run --features http,pcap --example http_log -- trace.pcap

use std::env;

use flowscope::extract::FiveTuple;
use flowscope::http::{HttpMessage, HttpParser};
use flowscope::pcap::PcapFlowSource;
use flowscope::{FlowSessionDriver, SessionEvent};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let path = env::args().nth(1).ok_or("usage: http_log <trace.pcap>")?;

    let mut driver = FlowSessionDriver::new(FiveTuple::bidirectional(), HttpParser::default());

    let mut reqs = 0u64;
    let mut resps = 0u64;
    let mut closed = 0u64;

    for view in PcapFlowSource::open(&path)?.views() {
        let view = view?;
        for ev in driver.track(&view) {
            match ev {
                SessionEvent::Application {
                    message: HttpMessage::Request(req),
                    ..
                } => {
                    reqs += 1;
                    let host = req
                        .headers
                        .iter()
                        .find(|(n, _)| n.eq_ignore_ascii_case("host"))
                        .map(|(_, v)| String::from_utf8_lossy(v).to_string())
                        .unwrap_or_default();
                    println!(
                        "→ {} {}{}  ({} bytes)",
                        req.method,
                        host,
                        req.path,
                        req.body.len()
                    );
                }
                SessionEvent::Application {
                    message: HttpMessage::Response(resp),
                    ..
                } => {
                    resps += 1;
                    let ct = resp
                        .headers
                        .iter()
                        .find(|(n, _)| n.eq_ignore_ascii_case("content-type"))
                        .map(|(_, v)| String::from_utf8_lossy(v).to_string())
                        .unwrap_or_else(|| "(none)".into());
                    println!(
                        "← {} {}  ({} bytes, content-type: {})",
                        resp.status,
                        resp.reason,
                        resp.body.len(),
                        ct
                    );
                }
                SessionEvent::Closed { .. } => closed += 1,
                _ => {}
            }
        }
    }
    for ev in driver.finish() {
        if matches!(ev, SessionEvent::Closed { .. }) {
            closed += 1;
        }
    }

    eprintln!("\n--- summary: {reqs} requests, {resps} responses, {closed} flow ends");
    Ok(())
}