flowscope 0.3.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

//! Source-agnostic flow extraction example: read a pcap, run a
//! `FiveTuple::bidirectional()` extractor over each frame, print
//! the canonical flow keys.
//!
//! Demonstrates that `netring-flow` works without `netring` —
//! pcap input only, no Linux capture, no tokio.
//!
//! Usage:
//!     cargo run -p netring-flow --example pcap_flow_keys -- path/to/trace.pcap

use std::env;
use std::fs::File;
use std::io::BufReader;

use flowscope::extract::FiveTuple;
use flowscope::{FlowExtractor, PacketView, Timestamp};

use pcap_file::pcap::PcapReader;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let path = env::args()
        .nth(1)
        .ok_or("usage: pcap_flow_keys <trace.pcap>")?;
    let file = File::open(&path)?;
    let mut reader = PcapReader::new(BufReader::new(file))?;
    let extractor = FiveTuple::bidirectional();

    let mut total = 0usize;
    let mut extracted = 0usize;

    while let Some(pkt) = reader.next_packet() {
        let pkt = pkt?;
        total += 1;
        let ts = Timestamp::new(pkt.timestamp.as_secs() as u32, pkt.timestamp.subsec_nanos());
        let view = PacketView::new(&pkt.data, ts);

        if let Some(e) = extractor.extract(view) {
            extracted += 1;
            println!(
                "{ts:>20}  {proto:?}  {a} <-> {b}  orientation={ori:?}",
                ts = ts,
                proto = e.key.proto,
                a = e.key.a,
                b = e.key.b,
                ori = e.orientation,
            );
        }
    }

    eprintln!(
        "\n--- summary: {extracted}/{total} packets extracted",
        extracted = extracted,
        total = total,
    );
    Ok(())
}