1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
//! Unified multi-protocol event surface.
//!
//! [`ProtocolEvent<K>`] is a sum-type over the lifecycle events
//! that come out of flowscope's `FlowTracker` plus the L7 messages
//! emitted by HTTP / DNS / TLS parsers. It's the canonical event
//! type for **multi-protocol anomaly correlation** — see
//! [`crate::correlate`] for the primitives that consume it.
//!
//! [`ProtocolMonitor<K>`] is the entry point: declare which
//! protocols you care about (`flow()`, `http()`, `dns()`, `tls()`),
//! the monitor orchestrates one filtered `AsyncCapture` per
//! protocol and yields events through a unified async stream.
//!
//! ```no_run
//! # #[cfg(all(feature = "tokio", feature = "http", feature = "dns"))]
//! # async fn _ex() -> Result<(), Box<dyn std::error::Error>> {
//! use futures::StreamExt;
//! use netring::flow::extract::FiveTuple;
//! use netring::protocol::{ProtocolEvent, ProtocolMessage, ProtocolMonitorBuilder};
//!
//! let mut monitor = ProtocolMonitorBuilder::new()
//! .interface("eth0")
//! .flow()
//! .http()
//! .dns()
//! .build(FiveTuple::bidirectional())?;
//!
//! while let Some(evt) = monitor.next().await {
//! match evt? {
//! ProtocolEvent::Flow(_) => { /* flow lifecycle */ }
//! ProtocolEvent::Message { kind, message: ProtocolMessage::Http(_), .. } => {
//! let _ = kind;
//! }
//! ProtocolEvent::Message { message: ProtocolMessage::Dns(_), .. } => {
//! /* dns query/response/unanswered */
//! }
//! _ => {}
//! }
//! }
//! # Ok(()) }
//! ```
pub use ;
pub use ;