flowscope 0.20.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

//! pcap file source for offline replay.
//!
//! Wraps [`pcap-file`](https://crates.io/crates/pcap-file). Removes
//! the boilerplate every program needs to feed a pcap into a
//! [`FlowTracker`](crate::FlowTracker).
//!
//! # Quick start
//!
//! ```no_run
//! use flowscope::pcap::PcapFlowSource;
//! use flowscope::extract::FiveTuple;
//! use flowscope::FlowEvent;
//!
//! # fn main() -> Result<(), Box<dyn std::error::Error>> {
//! for evt in PcapFlowSource::open("trace.pcap")?.with_extractor(FiveTuple::bidirectional()) {
//!     if let FlowEvent::Started { key, .. } = evt? {
//!         println!("{} <-> {}", key.a, key.b);
//!     }
//! }
//! # Ok(()) }
//! ```

// Generic per-parser message iterators (issue #86) — need the
// session pipeline to drive a SessionParser / DatagramParser.
#[cfg(all(feature = "session", feature = "reassembler"))]
mod messages;
// Unified lifecycle + message stream (issue #111).
#[cfg(all(feature = "session", feature = "reassembler"))]
mod pulses;
mod source;
#[cfg(feature = "tracker")]
mod summaries;

#[cfg(all(feature = "session", feature = "reassembler"))]
pub use messages::{datagram_messages, session_messages};
#[cfg(all(feature = "session", feature = "reassembler"))]
pub use pulses::{Pulse, datagram_pulses, session_pulses};
pub use source::{EventIter, OwnedPacketView, PcapFlowSource, ViewIter};
#[cfg(feature = "tracker")]
#[allow(deprecated)]
pub use summaries::{FlowSummary, flow_summaries, flow_summaries_from_pcap};