flowscope 0.16.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

//! Export every `FlowEvent::Ended` as a newline-delimited JSON
//! object (NDJSON).
//!
//! Uses [`flowscope::emit::FlowEventNdjsonWriter`] (0.10 — plan
//! 101). Per-field shape is the snake_case wire vocabulary locked
//! since 0.8. Drop-in input for Elasticsearch / Loki /
//! ClickHouse / DuckDB.
//!
//! ```bash
//! cargo run --features pcap,emit-ndjson \
//!     --example flow_json_export -- trace.pcap > flows.ndjson
//! ```

use std::io::{BufWriter, stdout};

use flowscope::FlowTracker;
use flowscope::emit::FlowEventNdjsonWriter;
use flowscope::extract::FiveTuple;
use flowscope::pcap::PcapFlowSource;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let path = std::env::args()
        .nth(1)
        .unwrap_or_else(|| "tests/data/mixed_short.pcap".to_string());

    let mut tracker = FlowTracker::<FiveTuple>::new(FiveTuple::bidirectional());
    let mut ndjson = FlowEventNdjsonWriter::new(BufWriter::new(stdout().lock()));

    for owned in PcapFlowSource::open(&path)?.views() {
        let owned = owned?;
        for ev in tracker.track(&owned) {
            ndjson.write_event(&ev)?;
        }
    }
    for ev in tracker.finish() {
        ndjson.write_event(&ev)?;
    }
    ndjson.finish()?;
    Ok(())
}