1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
//! `flowscope::nprint` — nPrint (CCS 2021) per-packet header-bit
//! matrix for model-agnostic ML pipelines.
//!
//! Gated by the `ml-features-nprint` Cargo feature. Issue #30.
//!
//! ## What ships
//!
//! [`NPrintMatrix`] is an append-only bounded matrix of
//! [`NPrintRow`]s, one per packet observed in the flow. Each row
//! is a ternary vector — `-1` (absent), `0`, `1` — encoding a
//! per-header-bit representation of the packet:
//!
//! - **Ethernet** — 14 bytes (112 bits): dst_mac + src_mac +
//! ethertype.
//! - **IPv4 base header** — 20 bytes (160 bits). IPv4 options
//! are NOT encoded in this release.
//! - **TCP base header** — 20 bytes (160 bits). TCP options
//! absent / unparsed → encoded as `-1` placeholders only when
//! the row is allocated with `with_tcp_options(true)`.
//! - **UDP** — 8 bytes (64 bits).
//!
//! When a layer is absent the corresponding region is filled
//! with `-1`s; when present the bits are extracted MSB-first
//! per byte.
//!
//! The per-row width is fixed at construction time via
//! [`NPrintConfig`] so all rows in the same matrix have the
//! same shape (a hard requirement for ML downstream).
//!
//! ## Why opt-in
//!
//! Per-packet storage is non-trivial. With 100 packets per flow
//! and a row of 14+20+20 = 54 bytes = 432 bits per row stored
//! as `Vec<NPrintBit>` (one byte per bit), the per-flow cost is
//! ~43 KiB. The aggregated stats in [`crate::ml_features`] are
//! O(1) per flow.
//!
//! ## Reference
//!
//! - <https://nprint.github.io/papers/nprint-ccs21.pdf>
//! - <https://github.com/nprint/nprint>
//!
//! ## Example
//!
//! ```no_run
//! # #[cfg(all(feature = "ml-features-nprint", feature = "extractors"))]
//! # fn _ex(view: flowscope::PacketView<'_>) {
//! use flowscope::nprint::{NPrintConfig, NPrintMatrix};
//!
//! let cfg = NPrintConfig::default();
//! let mut m = NPrintMatrix::new(cfg);
//! m.push_view(&view);
//! assert_eq!(m.rows().len(), 1);
//! # }
//! ```
pub use ;
pub use ;