flowscope 0.17.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

//! `use flowscope::prelude::*;` — one import for the common types.
//!
//! Re-exports the types most users want without typing
//! `use flowscope::{Driver, Event, Timestamp, …};` every time.
//! Power users can keep the explicit imports; this module is the
//! "I'm starting a new project" convenience.
//!
//! ```ignore
//! use flowscope::prelude::*;
//!
//! let mut builder = Driver::builder(FiveTuple::bidirectional());
//! let mut driver = builder.build();
//! ```

pub use crate::{
    AnomalyFields, AsPacketView, ChecksumStatus, Error, ErrorCode, ErrorKind, KeyFields, MacAddr,
    Module, PacketView, Result, RssHashType, RxHash, RxMetadata, Timestamp, VlanProto, VlanTag,
};

// Issue #1 (0.17): ARP visibility surface.
#[cfg(feature = "arp")]
pub use crate::arp::{ArpMessage, ArpOp};

#[cfg(feature = "extractors")]
pub use crate::extract::{FiveTuple, Tagged, TaggedKey};

#[cfg(feature = "extractors")]
pub use crate::extractor::{Extracted, FlowExtractor, L4Proto, Orientation, TcpFlags, TcpInfo};

#[cfg(feature = "tracker")]
pub use crate::event::{AnomalyKind, EndReason, FlowEvent, FlowSide, FlowStats};

#[cfg(feature = "tracker")]
pub use crate::tracker::{FlowTracker, FlowTrackerConfig};

// Plan 167 (0.14): discoverability sweep — surface the
// `correlate::*` primitives in the prelude so users don't
// have to know the module path to find them.
#[cfg(all(feature = "tracker", feature = "extractors"))]
pub use crate::correlate::FlowStateMap;
#[cfg(feature = "tracker")]
pub use crate::correlate::{
    BurstDetector, Ewma, KeyIndexed, RollingRate, TimeBucketedCounter, TimeBucketedSet, TopK,
};

#[cfg(feature = "session")]
pub use crate::session::{DatagramParser, SessionEvent, SessionParser};

#[cfg(all(feature = "reassembler", feature = "session"))]
pub use crate::FlowSessionDriver;

#[cfg(all(feature = "extractors", feature = "reassembler", feature = "session"))]
pub use crate::FlowDatagramDriver;

/// The typed [`crate::driver::Driver`] +
/// [`crate::driver::SlotHandle`] shape (plan 121).
#[cfg(all(feature = "extractors", feature = "reassembler", feature = "session"))]
pub use crate::driver::{Driver, DriverBuilder, Event, SlotHandle, SlotMessage};

#[cfg(feature = "extractors")]
pub use crate::layers::{Layer, LayerKind, LayerParser, LayerStack, Layers};

#[cfg(feature = "pcap")]
pub use crate::pcap::PcapFlowSource;

// Plan 162 (0.14): ICMP error classification — frequently
// imported by `on_icmp_error` consumers.
// Plan 170 (0.14): `MtuSignalKind` added for PMTU events.
#[cfg(feature = "icmp")]
pub use crate::icmp::{DestUnreachableKind, IcmpInner, IcmpMessage, IcmpType, MtuSignalKind};

// Plan 165 (0.14): site-custom port label table.
#[cfg(feature = "extractors")]
pub use crate::well_known::LabelTable;

// Issue #1 (0.17): NeighborTable IP→link-layer binding tracker.
#[cfg(feature = "tracker")]
pub use crate::correlate::{NeighborBinding, NeighborEvent, NeighborTable};

// Issue #4 (0.17): behavioural-fingerprint primitives.
#[cfg(feature = "fingerprint")]
pub use crate::detect::fingerprint::{FingerprintBuilder, FlowFingerprint};