flowscope 0.22.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

//! Export ended flows as CSV — one row per `FlowEvent::Ended`.
//!
//! Uses [`flowscope::emit::FlowEventCsvWriter`] (0.10 — plan 101)
//! to handle the schema, RFC-4180 quoting, and header generation.
//!
//! Suitable for piping into a spreadsheet, a relational DB, or
//! pandas / DuckDB for ad-hoc analysis.
//!
//! ```bash
//! cargo run --features pcap,emit --example flow_csv_export \
//!     -- trace.pcap > flows.csv
//! ```

use std::io::{BufWriter, stdout};

use flowscope::{FlowTracker, emit::FlowEventCsvWriter, extract::FiveTuple, pcap::PcapFlowSource};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let path = std::env::args()
        .nth(1)
        .unwrap_or_else(|| "tests/data/mixed_short.pcap".to_string());

    let mut tracker = FlowTracker::<FiveTuple>::new(FiveTuple::bidirectional());
    let mut csv = FlowEventCsvWriter::new(BufWriter::new(stdout().lock()))?;

    for owned in PcapFlowSource::open(&path)?.views() {
        let owned = owned?;
        for ev in tracker.track(&owned) {
            csv.write_event(&ev)?;
        }
    }
    for ev in tracker.finish() {
        csv.write_event(&ev)?;
    }
    csv.finish()?;
    Ok(())
}