flowscope 0.11.1

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

//! Export ended flows as CSV — one row per `FlowEvent::Ended`.
//!
//! Uses [`flowscope::emit::FlowEventCsvWriter`] (0.10 — plan 101)
//! to handle the schema, RFC-4180 quoting, and header generation.
//!
//! Suitable for piping into a spreadsheet, a relational DB, or
//! pandas / DuckDB for ad-hoc analysis.
//!
//! ```bash
//! cargo run --features pcap,emit --example flow_csv_export \
//!     -- trace.pcap > flows.csv
//! ```

use std::io::{BufWriter, stdout};

use flowscope::FlowTracker;
use flowscope::emit::FlowEventCsvWriter;
use flowscope::extract::FiveTuple;
use flowscope::pcap::PcapFlowSource;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let path = std::env::args()
        .nth(1)
        .unwrap_or_else(|| "tests/data/mixed_short.pcap".to_string());

    let mut tracker = FlowTracker::<FiveTuple>::new(FiveTuple::bidirectional());
    let mut csv = FlowEventCsvWriter::new(BufWriter::new(stdout().lock()))?;

    for owned in PcapFlowSource::open(&path)?.views() {
        let owned = owned?;
        for ev in tracker.track(&owned) {
            csv.write_event(&ev)?;
        }
    }
    for ev in tracker.finish() {
        csv.write_event(&ev)?;
    }
    csv.finish()?;
    Ok(())
}