mquire 1.2.7

Memory forensics and analysis tool for querying Linux kernel memory dumps using SQL
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

//
// Copyright (c) 2025-present, Trail of Bits, Inc.
// All rights reserved.
//
// This source code is licensed in accordance with the terms specified in
// the LICENSE file found in the root directory of this source tree.
//

use crate::{core::entities::ip_address::IPAddress, memory::virtual_address::VirtualAddress};

/// Network mask representation
#[derive(Debug, Clone)]
pub enum NetworkMask {
    /// IPv4 dotted-decimal notation (example: "255.255.255.0")
    DottedDecimal(String),

    /// IPv6 prefix length (example: 64)
    PrefixLength(usize),
}

/// IP address with its associated network mask
#[derive(Debug, Clone)]
pub struct IPAddressAndMask {
    /// IP address
    pub ip_address: IPAddress,

    /// Network mask (dotted-decimal notation for IPv4, prefix length for IPv6)
    pub mask: NetworkMask,
}

/// Network interface entity
pub struct NetworkInterface {
    /// Virtual address of the net_device structure
    pub virtual_address: VirtualAddress,

    /// Interface name
    pub name: Option<String>,

    /// Current active MAC address
    pub active_mac_address: Option<String>,

    /// Physical MAC address
    pub physical_mac_address: Option<String>,

    /// Additional MAC addresses
    pub additional_mac_addresses: Vec<String>,

    /// List of IP addresses with their masks
    pub ip_addresses: Vec<IPAddressAndMask>,

    /// Interface state (OS specific)
    pub state: Option<String>,
}