Enum FlowEvent 

pub enum FlowEvent<K> {
    Started {
        key: K,
        side: FlowSide,
        ts: Timestamp,
        l4: Option<L4Proto>,
    },
    Packet {
        key: K,
        side: FlowSide,
        len: usize,
        ts: Timestamp,
    },
    Established {
        key: K,
        ts: Timestamp,
    },
    StateChange {
        key: K,
        from: FlowState,
        to: FlowState,
        ts: Timestamp,
    },
    Ended {
        key: K,
        reason: EndReason,
        stats: FlowStats,
        history: HistoryString,
    },
    Anomaly {
        key: Option<K>,
        kind: AnomalyKind,
        ts: Timestamp,
    },
}

Available on crate feature tracker only.

Events emitted by the tracker.

One packet typically produces one or two events. The Started event fires on first sight of a flow and is followed by a Packet event for the same packet. Subsequent packets of the same flow produce a single Packet event each. TCP-aware events (Established, StateChange) fire only when the extractor supplied crate::TcpInfo.

Variants

Started

First packet of a new flow.

Fields

key: K

side: FlowSide

ts: Timestamp

l4: Option<L4Proto>

Packet

Subsequent packet on a known flow.

Fields

key: K

side: FlowSide

len: usize

ts: Timestamp

Established

TCP only — 3WHS completed for this flow.

Fields

key: K

ts: Timestamp

StateChange

State machine transitioned. Fires for TCP non-Established transitions (e.g., Established → FinWait).

Fields

key: K

from: FlowState

to: FlowState

ts: Timestamp

Ended

Flow ended (FIN/RST for TCP, idle/eviction for any flow).

Fields

key: K

reason: EndReason

stats: FlowStats

history: HistoryString

Anomaly

Live, in-flight anomaly. The flow is still alive (use Ended for end-of-life events). Opt-in: emitted only when crate::FlowDriver::with_emit_anomalies is true.

key is None for tracker-global anomalies (e.g. AnomalyKind::FlowTableEvictionPressure); Some(key) for per-flow anomalies.

Fields

key: Option<K>

kind: AnomalyKind

ts: Timestamp

Implementations

impl<K> FlowEvent<K>

pub fn key(&self) -> Option<&K>

Borrow the key without moving it. Useful for filter combinators.

Returns None for tracker-global FlowEvent::Anomaly events that don’t belong to a single flow.

Trait Implementations

impl<K: Clone> Clone for FlowEvent<K>

fn clone(&self) -> FlowEvent<K>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<K: Debug> Debug for FlowEvent<K>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.