flowscope 0.7.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

//! Plan 82 — `Severity` enum + `AnomalyKind::severity()`.
//! Every variant maps to the documented default; ordering
//! works for `>=` filter thresholds.

#![cfg(feature = "reassembler")]

use flowscope::event::{AnomalyKind, FlowSide, OverflowPolicy, Severity};

#[test]
fn severity_ordering_is_ascending() {
    assert!(Severity::Info < Severity::Warning);
    assert!(Severity::Warning < Severity::Error);
    assert!(Severity::Error < Severity::Critical);
    // Sanity: equality on the same variant.
    assert_eq!(Severity::Warning, Severity::Warning);
}

#[test]
fn severity_is_copy_and_hash() {
    fn assert_copy<T: Copy>() {}
    fn assert_hash<T: std::hash::Hash>() {}
    assert_copy::<Severity>();
    assert_hash::<Severity>();
}

#[test]
fn out_of_order_segment_defaults_info() {
    let kind = AnomalyKind::OutOfOrderSegment {
        side: FlowSide::Initiator,
        count: 3,
    };
    assert_eq!(kind.severity(), Severity::Info);
}

#[test]
fn retransmitted_segment_defaults_info() {
    let kind = AnomalyKind::RetransmittedSegment {
        side: FlowSide::Responder,
        count: 1,
    };
    assert_eq!(kind.severity(), Severity::Info);
}

#[test]
fn buffer_overflow_defaults_warning() {
    let kind = AnomalyKind::BufferOverflow {
        side: FlowSide::Initiator,
        bytes: 1024,
        policy: OverflowPolicy::SlidingWindow,
    };
    assert_eq!(kind.severity(), Severity::Warning);
    // DropFlow policy maps the same way — the policy variation
    // is operator information, not severity.
    let kind = AnomalyKind::BufferOverflow {
        side: FlowSide::Initiator,
        bytes: 1024,
        policy: OverflowPolicy::DropFlow,
    };
    assert_eq!(kind.severity(), Severity::Warning);
}

#[test]
fn reassembler_high_watermark_defaults_warning() {
    let kind = AnomalyKind::ReassemblerHighWatermark {
        side: FlowSide::Initiator,
        bytes: 800,
        cap: 1000,
        threshold_pct: 80,
    };
    assert_eq!(kind.severity(), Severity::Warning);
}

#[test]
fn flow_table_eviction_pressure_defaults_warning() {
    let kind = AnomalyKind::FlowTableEvictionPressure {
        evicted_in_tick: 5,
        evicted_total: 42,
    };
    assert_eq!(kind.severity(), Severity::Warning);
}

#[test]
fn session_parse_error_defaults_error() {
    let kind = AnomalyKind::SessionParseError {
        side: FlowSide::Initiator,
        reason: Some("bad frame".into()),
    };
    assert_eq!(kind.severity(), Severity::Error);
}

#[test]
fn severity_display_renders_lowercase() {
    assert_eq!(format!("{}", Severity::Info), "info");
    assert_eq!(format!("{}", Severity::Warning), "warning");
    assert_eq!(format!("{}", Severity::Error), "error");
    assert_eq!(format!("{}", Severity::Critical), "critical");
}

#[test]
fn severity_filter_threshold_works() {
    // Canonical operator pattern: route only Warning+ to alerts.
    let kinds = [
        AnomalyKind::OutOfOrderSegment {
            side: FlowSide::Initiator,
            count: 1,
        },
        AnomalyKind::BufferOverflow {
            side: FlowSide::Initiator,
            bytes: 1,
            policy: OverflowPolicy::SlidingWindow,
        },
        AnomalyKind::SessionParseError {
            side: FlowSide::Initiator,
            reason: None,
        },
    ];
    let high_sev: Vec<_> = kinds
        .iter()
        .filter(|k| k.severity() >= Severity::Warning)
        .collect();
    assert_eq!(high_sev.len(), 2); // BufferOverflow + SessionParseError
}