netring 0.29.0

High-performance zero-copy packet I/O for Linux (AF_PACKET TPACKET_V3 + AF_XDP)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

//! Detector registry wiring (issue #127).
//!
//! Cap-free: `.detector(..)` / `.detectors(..)` accept flowscope detectors, seed
//! a `DetectorCell` at build, and the Monitor builds without a capture. The
//! detectors' emission logic is unit-tested upstream in flowscope; the ATT&CK
//! observation append is tested in `netring::anomaly::sink`.

#![cfg(all(feature = "tokio", feature = "flow"))]

use flowscope::detect::patterns::{BeaconDetector, PortScanDetector};
use flowscope::detect::{DetectorRegistry, HostPair, SrcHost};
use flowscope::extract::FiveTupleKey;
use netring::monitor::Monitor;
use netring::prelude::StdoutSink;

#[tokio::test(flavor = "current_thread")]
async fn detector_builds_and_accumulates() {
    let m = Monitor::builder()
        .interface("lo")
        .detector(PortScanDetector::<SrcHost>::new())
        .detector(BeaconDetector::<HostPair>::new())
        .sink(StdoutSink::default())
        .build();
    assert!(m.is_ok(), "detector build failed: {:?}", m.err());
}

#[tokio::test(flavor = "current_thread")]
async fn detectors_registry_builds() {
    let mut reg: DetectorRegistry<FiveTupleKey> = DetectorRegistry::new();
    reg.register(PortScanDetector::<SrcHost>::new());
    let m = Monitor::builder()
        .interface("lo")
        .detectors(reg)
        .sink(StdoutSink::default())
        .build();
    assert!(m.is_ok(), "detectors registry build failed: {:?}", m.err());
}