flowscope 0.22.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

//! Built-in flow extractors and decap combinators.
//!
//! Available with the `extractors` feature (default-on).
//!
//! - [`FiveTuple`] — protocol + (src, dst) endpoints. Bidirectional
//!   by default (A→B and B→A merged).
//! - [`IpPair`] — IP address pair only; protocol ignored. Useful for
//!   ICMP and fragmented flows.
//! - [`MacPair`] — L2 MAC pair. Useful for ARP, BPDU, LLDP.
//!
//! Decap combinators wrap any extractor and peel one encapsulation
//! layer first:
//!
//! - [`StripVlan<E>`] — strip 802.1Q VLAN tag(s)
//! - [`StripMpls<E>`] — strip MPLS label stack
//! - [`InnerVxlan<E>`] — decap VXLAN, run extractor on inner Ethernet
//! - [`InnerGtpU<E>`] — decap GTP-U, run extractor on inner IP
//! - [`InnerGre<E>`] — decap GRE (IP proto 47), run extractor on
//!   inner IPv4/IPv6 (or inner Ethernet for TEB)
//! - [`AutoDetectEncap<E>`] — try plain → VLAN → MPLS → VXLAN →
//!   GTP-U → GRE in order; first match wins
//!
//! Key augmentation:
//!
//! - [`FlowLabel<E>`] — append the IPv6 flow label (RFC 6437) to
//!   any inner key. IPv4 packets get `label = 0`.
//!
//! Combinators compose: `StripVlan(InnerVxlan::new(FiveTuple::bidirectional()))`.

#[cfg(any(test, feature = "test-helpers"))]
pub mod parse;
#[cfg(not(any(test, feature = "test-helpers")))]
pub(crate) mod parse;

pub mod five_tuple;
pub mod ip_pair;
pub mod mac_pair;

pub mod encap_gre;
pub mod encap_gtp;
pub mod encap_mpls;
pub mod encap_vlan;
pub mod encap_vxlan;

pub mod auto_detect;
pub mod flow_label;
pub mod tagged;

pub use auto_detect::{AutoDetectEncap, AutoEncapVariants};
pub use encap_gre::InnerGre;
pub use encap_gtp::InnerGtpU;
pub use encap_mpls::StripMpls;
pub use encap_vlan::StripVlan;
pub use encap_vxlan::InnerVxlan;
pub use five_tuple::{FiveTuple, FiveTupleKey};
pub use flow_label::{FlowLabel, FlowLabelKey};
pub use ip_pair::{IpPair, IpPairKey};
pub use mac_pair::{MacPair, MacPairKey};
pub use tagged::{Tagged, TaggedKey, Tagger};