netrain 0.2.8

Matrix-style network packet monitor with IP tracking, threat detection and real-time visualization
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

// Protocol activity tracking for time-series visualization

use std::collections::VecDeque;
use crate::Protocol;

const HISTORY_SIZE: usize = 60; // Keep 60 time slices

#[derive(Debug, Clone)]
pub struct ProtocolSnapshot {
    pub tcp: u64,
    pub udp: u64,
    pub http: u64,
    pub https: u64,
    pub dns: u64,
    pub ssh: u64,
    pub unknown: u64,
    pub total: u64,
}

impl ProtocolSnapshot {
    fn new() -> Self {
        Self {
            tcp: 0,
            udp: 0,
            http: 0,
            https: 0,
            dns: 0,
            ssh: 0,
            unknown: 0,
            total: 0,
        }
    }
}

pub struct ProtocolActivityTracker {
    history: VecDeque<ProtocolSnapshot>,
    current: ProtocolSnapshot,
}

impl ProtocolActivityTracker {
    pub fn new() -> Self {
        Self {
            history: VecDeque::with_capacity(HISTORY_SIZE),
            current: ProtocolSnapshot::new(),
        }
    }
    
    pub fn record_packet(&mut self, protocol: Protocol) {
        match protocol {
            Protocol::TCP => self.current.tcp += 1,
            Protocol::UDP => self.current.udp += 1,
            Protocol::HTTP => self.current.http += 1,
            Protocol::HTTPS => self.current.https += 1,
            Protocol::DNS => self.current.dns += 1,
            Protocol::SSH => self.current.ssh += 1,
            Protocol::Unknown => self.current.unknown += 1,
        }
        self.current.total += 1;
    }
    
    pub fn tick(&mut self) {
        // Push current snapshot to history and reset
        self.history.push_back(self.current.clone());
        if self.history.len() > HISTORY_SIZE {
            self.history.pop_front();
        }
        self.current = ProtocolSnapshot::new();
    }
    
    pub fn get_history(&self) -> &VecDeque<ProtocolSnapshot> {
        &self.history
    }
    
    pub fn get_sparkline_data(&self, protocol: Protocol) -> Vec<u64> {
        // Include current snapshot for real-time display
        let mut data: Vec<u64> = self.history.iter().map(|snapshot| {
            match protocol {
                Protocol::TCP => snapshot.tcp,
                Protocol::UDP => snapshot.udp,
                Protocol::HTTP => snapshot.http,
                Protocol::HTTPS => snapshot.https,
                Protocol::DNS => snapshot.dns,
                Protocol::SSH => snapshot.ssh,
                Protocol::Unknown => snapshot.unknown,
            }
        }).collect();
        
        // Add current snapshot value for immediate feedback
        data.push(match protocol {
            Protocol::TCP => self.current.tcp,
            Protocol::UDP => self.current.udp,
            Protocol::HTTP => self.current.http,
            Protocol::HTTPS => self.current.https,
            Protocol::DNS => self.current.dns,
            Protocol::SSH => self.current.ssh,
            Protocol::Unknown => self.current.unknown,
        });
        
        // Pad with zeros at the beginning if we don't have enough history
        while data.len() < 20 {
            data.insert(0, 0);
        }
        
        // Return last 20 values for display
        if data.len() > 20 {
            data.split_off(data.len() - 20)
        } else {
            data
        }
    }
    
    pub fn get_max_value(&self) -> u64 {
        let history_max = self.history.iter()
            .map(|s| s.total)
            .max()
            .unwrap_or(0);
        
        // Include current snapshot in max calculation
        history_max.max(self.current.total).max(1)
    }
}