Crate flowscope 

flowscope — passive flow & session tracking for packet capture.

Cross-platform, runtime-free library for observing what’s happening on the wire. Pair with any source of &[u8] frames: netring (Linux AF_PACKET / AF_XDP), pcap files, tun-tap, eBPF, embedded.

What’s here

Core (always on):

• PacketView / Timestamp — the abstract input.
• FlowExtractor — turn a frame into a flow descriptor.
• FlowTracker — bidirectional flow accounting + TCP state machine + idle/eviction policy. Hot-cache fast path on monoflow workloads.
• Reassembler — sync per-(flow, side) TCP byte stream hook. Optional per-side buffer cap with OverflowPolicy (sliding-window or drop-flow).
• SessionParser / DatagramParser — typed L7 message parsing per flow.
• FlowDriver — sync wrapper combining the tracker with a reassembler factory; optional anomaly emission via FlowDriver::with_emit_anomalies.
• driver::Driver — typed flow-lifecycle driver; register one session/datagram slot per protocol for typed L7 messages. This replaced the per-parser FlowSessionDriver / FlowDatagramDriver in 0.20 (#99).

Built-in extractors and decap combinators (extractors feature):

• extract::FiveTuple, extract::IpPair, extract::MacPair
• extract::StripVlan, extract::StripMpls, extract::InnerVxlan, extract::InnerGtpU, extract::InnerGre, extract::AutoDetectEncap, extract::FlowLabel

Cargo features

Granular leaf flags compose into coarse umbrellas. Pick the smallest that fits; --all-features (docs.rs) turns on everything including the FoxIO-licensed ja4plus.

Umbrellas & tiers — correct, coarse groupings (issue #87):

Feature	Pulls
full	l7 + every license-clean capability (excludes FoxIO ja4plus)
l7	every license-clean wire parser (the three parsers-* tiers + tls-fingerprints)
parsers-core	http tls dns icmp
parsers-l2l3	arp ndp lldp cdp dhcp (L2/L3 asset discovery)
parsers-tier2	the 19 Tier-2 parsers (ssh ntp ssdp tftp mdns netbios-ns ftp smtp wireguard modbus stun rdp snmp radius quic smb ldap kerberos dnp3)
nsm	network-security monitoring: fingerprint + tls-fingerprints + analysis
ml	ml-features + ml-features-nprint
export	ipfix + ipfix-export + the emit* writers

Protocol parsers (each behind its own feature):

Feature	Module	What you get
http	http	HTTP/1.x request/response parser
tls	tls	TLS handshake observer (ClientHello/ServerHello/Alert)
dns	dns	DNS-over-UDP/TCP parsers + query/response correlator
icmp	icmp	ICMPv4/v6 decoder + inner-flow correlation
arp	arp	ARP + correlate::NeighborTable binding tracker
ndp	ndp	IPv6 Neighbor Discovery (ICMPv6 135/136)
dhcp	dhcp	DHCP/BOOTP options + Fingerbank-style fingerprint
lldp	lldp	LLDP (IEEE 802.1AB) L2 asset discovery
cdp	cdp	Cisco Discovery Protocol
ssh	ssh	SSH banner + KEXINIT + HASSH fingerprint
ntp	ntp	NTP (UDP/123); monlist amplification signal
ssdp	ssdp	SSDP/UPnP IoT discovery
tftp	tftp	TFTP (UDP/69) device-config-theft visibility
mdns	mdns	mDNS / DNS-SD service walker (pulls dns)
netbios-ns	netbios_ns	NetBIOS Name Service (UDP/137)
ftp	ftp	FTP control channel + AUTH-TLS upgrade
smtp	smtp	SMTP + AUTH base64 decode + STARTTLS
wireguard	wireguard	WireGuard handshake metadata
modbus	modbus	Modbus/TCP (502) ICS visibility
stun	stun	STUN (RFC 5389) WebRTC / NAT discovery
rdp	rdp	RDP X.224 negotiation metadata
snmp	snmp	SNMP v1/v2c (rusticata snmp-parser)
radius	radius	RADIUS auth/accounting (rusticata radius-parser)
quic	quic	QUIC Initial passive decrypt → SNI/ALPN
smb	smb	SMB2/3 lateral-movement decode
ldap	ldap	LDAP bind/search (rusticata ldap-parser)
kerberos	kerberos	Kerberos AS/TGS/KRB-ERROR
dnp3	dnp3	DNP3 (TCP/20000) OT/SCADA metadata

Capabilities & output:

Feature	Module	What you get
asset	asset	Asset + LRU Inventory; self-sufficient (pulls its discovery parsers)
analysis	analysis	FlowAnalyzer → risk / IOC enriched flow records
tcp_fingerprint	tcp_fingerprint	p0f-style passive TCP/IP OS fingerprint
fingerprint	detect::fingerprint	encrypted-flow behavioural fingerprint (not the JA4+ facade — see below)
tls-fingerprints	tls	JA3 + JA4 TLS client fingerprints (royalty-free)
ja4plus	tls	JA4S/JA4X server fingerprints (FoxIO License 1.1, off by default)
ml-features / ml-features-nprint	ml_features / nprint	CICFlowMeter vector / nPrint bit matrix
ipfix / ipfix-export	ipfix	IANA IE vocabulary / RFC 7011 binary encoder
emit / emit-ndjson / emit-eve	emit	CSV+Zeek / NDJSON / Suricata EVE writers
aggregate	aggregate	Histogram + Percentile (t-digest)
file-hash	detect::file	streaming SHA-256/MD5 + MIME-class detection
community-id	well_known	Corelight Community ID v1 flow hashing
chrono	Timestamp	chrono::DateTime<Utc> interop
pcap	pcap	pcap file source for offline replay
serde	—	Serialize/Deserialize on every public type (locks wire vocabulary)

Always-on modules (no feature gate):

Module	What you get
fingerprint	unified JA4+ facade — one import site for the whole family, grouped by license (distinct from the fingerprint-feature behavioural detector above)
app_proto	identify h2 / h3 + DoT / DoQ / DoH over an encrypted transport from ALPN / SNI / port (no decryption)
ip_fragment	IP fragment reassembly (RFC 791 key, RFC 5722 overlap-drop) — defeats fragmentation-based L4/L7 evasion

Observability (zero-cost when off):

Feature	What you get
metrics	Prometheus / OpenTelemetry counters, gauges, histograms (see obs)
tracing	Structured events on flow lifecycle + anomalies

Tokio integration

For async iteration over flow / session / datagram events, see netring’s AsyncCapture::flow_stream / .session_stream / .datagram_stream. Those depend on this crate’s traits. The sync analogue is the typed driver::Driver with one session/datagram slot per protocol.

Re-exporting flowscope types

Crates that re-export flowscope types (netring, sister crates, internal forks) should write intra-doc links in the bare [`FlowDriver`] form, not the explicit [`FlowDriver`](flowscope::FlowDriver) form. The explicit path duplicates what rustdoc already resolves through the re-export and trips the redundant_explicit_links lint under -D warnings. See recipes.md’s “Re-exporting flowscope types” section for the worked example.

Re-exports

pub use detector_kind::DetectorKind;

pub use mac_addr::MacAddr;

pub use parser_kind::ParserKind;

pub use rx_metadata::ChecksumStatus;

pub use rx_metadata::RssHashType;

pub use rx_metadata::RxHash;

pub use rx_metadata::RxMetadata;

pub use rx_metadata::VlanProto;

pub use rx_metadata::VlanTag;

pub use anomaly::DetectorScore;tracker

pub use anomaly::OwnedAnomaly;tracker

pub use detect::registry::Detector;tracker

pub use detect::registry::DetectorRegistry;tracker

pub use segment_reassembler::SegmentBufferReassembler;reassembler

pub use icmp::DestUnreachableKind;icmp

pub use icmp::MtuSignalKind;icmp

pub use arp::ArpMessage;arp

pub use arp::ArpOp;arp

pub use ndp::NdpKind;ndp

pub use ndp::NdpMessage;ndp

pub use dhcp::DhcpMessage;dhcp

pub use dhcp::DhcpMessageType;dhcp

pub use dhcp::DhcpOp;dhcp

pub use lldp::ChassisId;lldp

pub use lldp::LldpMessage;lldp

pub use lldp::PortId;lldp

pub use lldp::SystemCapabilities;lldp

pub use cdp::CdpAddress;cdp

pub use cdp::CdpCapabilities;cdp

pub use cdp::CdpMessage;cdp

pub use ntp::NtpLeapIndicator;ntp

pub use ntp::NtpMessage;ntp

pub use ntp::NtpMode;ntp

pub use ntp::NtpTimestamp;ntp

pub use ssdp::SsdpKind;ssdp

pub use ssdp::SsdpMessage;ssdp

pub use tftp::TftpErrorCode;tftp

pub use tftp::TftpMessage;tftp

pub use tftp::TftpMode;tftp

pub use tftp::TftpOpcode;tftp

pub use mdns::MdnsParser;mdns

pub use mdns::ServiceRecord;mdns

pub use netbios_ns::NbnsMessage;netbios-ns

pub use netbios_ns::NbnsOpcode;netbios-ns

pub use netbios_ns::NbnsParser;netbios-ns

pub use ftp::FtpCommand;ftp

pub use ftp::FtpMessage;ftp

pub use ftp::FtpParser;ftp

pub use ftp::FtpReplyClass;ftp

pub use ftp::TransferKind;ftp

pub use smtp::SmtpCommand;smtp

pub use smtp::SmtpMessage;smtp

pub use smtp::SmtpParser;smtp

pub use wireguard::WireGuardKind;wireguard

pub use wireguard::WireGuardMessage;wireguard

pub use wireguard::WireGuardParser;wireguard

pub use modbus::ModbusExceptionCode;modbus

pub use modbus::ModbusFunction;modbus

pub use modbus::ModbusMessage;modbus

pub use modbus::ModbusParser;modbus

pub use stun::StunClass;stun

pub use stun::StunMessage;stun

pub use stun::StunParser;stun

pub use rdp::RdpFailureCode;rdp

pub use rdp::RdpMessage;rdp

pub use rdp::RdpParser;rdp

pub use rdp::RdpProtocols;rdp

pub use snmp::SnmpMessage;snmp

pub use snmp::SnmpParser;snmp

pub use snmp::SnmpPduKind;snmp

pub use snmp::SnmpVersion;snmp

pub use radius::RadiusCodeKind;radius

pub use radius::RadiusMessage;radius

pub use radius::RadiusParser;radius

pub use dnp3::DnpAppFunctionKind;dnp3

pub use dnp3::DnpApplication;dnp3

pub use dnp3::DnpInternalIndications;dnp3

pub use dnp3::DnpLinkFunctionKind;dnp3

pub use dnp3::DnpMessage;dnp3

pub use dnp3::DnpParser;dnp3

pub use asset::Asset;asset

pub use asset::AssetCapabilities;asset

pub use asset::AssetFingerprints;asset

pub use asset::AssetRole;asset

pub use asset::AssetSourceSet;asset

pub use asset::Inventory;asset

pub use analysis::AnalyzedFlow;analysis

pub use analysis::FlowAnalyzer;analysis

pub use analysis::L7Summary;analysis

pub use tcp_fingerprint::TcpDirection;tcp_fingerprint

pub use tcp_fingerprint::TcpFingerprint;tcp_fingerprint

pub use ipfix::FlowRecord;ipfix

pub use ml_features::CicFlowFeatures;ml-features

pub use nprint::NPrintConfig;ml-features-nprint

pub use nprint::NPrintMatrix;ml-features-nprint

pub use nprint::NPrintRow;ml-features-nprint

pub use kerberos::KERBEROS_PORT;kerberos

pub use kerberos::KerberosEtype;kerberos

pub use kerberos::KerberosMessage;kerberos

pub use kerberos::KerberosMessageKind;kerberos

pub use kerberos::KerberosTcpParser;kerberos

pub use kerberos::KerberosUdpParser;kerberos

pub use ldap::LDAP_PORT;ldap

pub use ldap::LdapAuthKind;ldap

pub use ldap::LdapMessage;ldap

pub use ldap::LdapOperation;ldap

pub use ldap::LdapParser;ldap

pub use smb::DceRpcInterfaceUuid;smb

pub use smb::NtlmAuth;smb

pub use smb::SMB_PORT;smb

pub use smb::SmbCommand;smb

pub use smb::SmbDialect;smb

pub use smb::SmbMessage;smb

pub use smb::SmbParser;smb

pub use quic::QUIC_PORT;quic

pub use quic::QuicInitial;quic

pub use quic::QuicUdpParser;quic

pub use quic::QuicVersion;quic

pub use ssh::SshKexInit;ssh

pub use ssh::SshMessage;ssh

pub use ssh::SshParser;ssh

pub use anomaly_fields::AnomalyFields;

pub use anomaly_fields::KeyFields;

pub use dedup::Dedup;tracker

pub use event::AnomalyKind;tracker

pub use event::EndReason;tracker

pub use event::EventMask;tracker

pub use event::FlowEvent;tracker

pub use event::FlowSide;tracker

pub use event::FlowState;tracker

pub use event::FlowStats;tracker

pub use event::MemcapPolicy;tracker

pub use event::OverflowPolicy;tracker

pub use event::TcpOverlapPolicy;tracker

pub use extractor::Extracted;

pub use extractor::FlowExtractor;

pub use extractor::L4Proto;

pub use extractor::Orientation;

pub use extractor::TcpFlags;

pub use extractor::TcpInfo;

pub use flow_driver::FlowDriver;reassembler

pub use history::HistoryString;tracker

pub use reassembler::BufferedReassembler;reassembler

pub use reassembler::BufferedReassemblerFactory;reassembler

pub use reassembler::NoopReassembler;reassembler

pub use reassembler::NoopReassemblerFactory;reassembler

pub use reassembler::Reassembler;reassembler

pub use reassembler::ReassemblerFactory;reassembler

pub use session::AccumulatingSessionParser;session

pub use session::BufferedFrameDrain;session

pub use session::DatagramParser;session

pub use session::DatagramParserFactory;session

pub use session::FrameDrainError;session

pub use session::PerDatagramParser;session

pub use session::SessionParser;session

pub use session::SessionParserFactory;session

pub use tracker::FlowEntry;tracker

pub use tracker::FlowEvents;tracker

pub use tracker::FlowTracker;tracker

pub use tracker::FlowTrackerConfig;tracker

pub use tracker::FlowTrackerStats;tracker

Modules

aggregateaggregate

flowscope::aggregate — distribution / quantile primitives.

analysisanalysis

flowscope::analysis — the opt-in composition layer that turns parser output into enriched, SIEM-ready flow records.

anomalytracker

Canonical owned anomaly value type for detector-shaped emission and retention.

anomaly_fields

KeyFields + AnomalyFields — structured field access for emit writers (EVE, NDJSON, CSV, Zeek, custom).

app_proto

flowscope::app_proto — identify the application protocol riding an encrypted transport from passively-observable signals: ALPN, SNI, and the L4 port (issue #138).

arparp

ARP (Address Resolution Protocol) parser.

assetasset

Passive asset inventory — a unified Asset record over every L2/L3 discovery parser flowscope ships.

cdpcdp

CDP (Cisco Discovery Protocol) parser.

community_idcommunity-id

Community ID v1 flow hashing — the cross-tool standard for joining flows across Zeek, Suricata, Security Onion, Arkime and friends.

correlatetracker

flowscope::correlate — generic helpers for cross-flow correlation patterns.

deduptracker

Content-hash deduplication of packet views.

detect

flowscope::detect — lightweight detection primitives.

detector_kind

DetectorKind — typed detector identity.

dhcpdhcp

DHCP parser (RFC 2131 BOOTP + RFC 2132 options).

dnp3dnp3

DNP3 application-layer metadata-only parser.

dnsdns

Passive DNS parsing (UDP/53).

driverextractors and reassembler and session

flowscope::driver — the typed Driver<E> + SlotHandle<M, K> shape (plan 121).

emitemit

flowscope::emit — structured event sinks.

eventtracker

Events emitted by crate::FlowTracker as packets flow through it.

extractextractors

Built-in flow extractors and decap combinators.

extractor

FlowExtractor trait and its supporting types.

fingerprint

flowscope::fingerprint — one import site for the whole JA4+ fingerprint family (issue #136).

flow_driverreassembler

FlowDriver — sync wrapper that bundles a FlowTracker with a ReassemblerFactory and dispatches TCP segments to the right reassembler.

ftpftp

FTP — TCP/21 control channel parser.

historytracker

Compact lifecycle representation à la Zeek’s conn.log history.

httphttp

Passive HTTP/1.x observer.

icmpicmp

Passive ICMPv4 / ICMPv6 message parsing (plan 76).

ip_fragment

flowscope::ip_fragment — IP fragment reassembly (issue #138).

ipfixipfix

IPFIX (RFC 7011 / RFC 7012) Information Element vocabulary.

ja4lja4plus

JA4L / JA4LS latency fingerprint (“light distance”) — FoxIO.

kerberoskerberos

Kerberos (RFC 4120) passive metadata parser.

layersextractors

flowscope::layers — per-packet layered field access.

ldapldap

LDAP (RFC 4511) passive metadata parser — TCP/389.

lldplldp

LLDP parser (IEEE 802.1AB-2016, EtherType 0x88cc).

mac_addr

MacAddr — strongly-typed 48-bit Ethernet MAC address.

mdnsmdns

mDNS — Multicast DNS (RFC 6762) parser + service-discovery helpers.

ml_featuresml-features

flowscope::ml_features — CICFlowMeter-compatible per-flow feature vector subset for ML pipelines.

modbusmodbus

Modbus/TCP — TCP/502 passive parser.

ndpndp

IPv6 NDP (Neighbor Discovery Protocol) parser. RFC 4861.

netbios_nsnetbios-ns

NetBIOS Name Service (NBNS / NBT-NS) — RFC 1002 §4.2 over UDP/137.

nprintml-features-nprint

flowscope::nprint — nPrint (CCS 2021) per-packet header-bit matrix for model-agnostic ML pipelines.

ntpntp

NTP / SNTP parser. RFC 5905.

obstracker

Observability hooks — metrics counters and tracing events.

parser_kind

ParserKind — typed parser identity.

pcappcap

pcap file source for offline replay.

prelude

use flowscope::prelude::*; — one import for the common types.

quicquic

QUIC (RFC 9000) Initial-packet passive metadata parser.

radiusradius

RADIUS — UDP/1812 (auth) + UDP/1813 (accounting).

rdprdp

RDP — TCP/3389 X.224 Connection Request / Confirm parser.

reassemblerreassembler

Sync TCP reassembly hooks.

rx_metadata

RxMetadata — per-packet hardware-provided metadata from the NIC’s receive path.

segment_reassemblerreassembler

SegmentBufferReassembler — TCP reassembler with out-of-order hole-fill.

sessionsession

Pluggable L7 message parsers.

smbsmb

SMB (Server Message Block) v1 / v2 / v3 passive metadata parser — TCP/445.

smtpsmtp

SMTP — TCP/25 + submission (TCP/587) parser.

snmpsnmp

SNMP v1/v2c parser.

ssdpssdp

SSDP (Simple Service Discovery Protocol) parser.

sshssh

SSH handshake parser + HASSH fingerprint.

stunstun

STUN — RFC 5389 / 8489 over UDP (typically 3478).

tcp_fingerprinttcp_fingerprint

p0f-style passive TCP/IP stack fingerprint.

tcp_statetracker and (test-helpers)

TCP state machine used internally by crate::FlowTracker.

test_helperssession and (test-helpers)

Parser stubs for downstream test crates. Gated by the test-helpers feature; not for production use. Parser stubs intended for downstream test crates that need a SessionParser / DatagramParser impl but don’t care about the produced messages.

tftptftp

TFTP (Trivial File Transfer Protocol) parser.

tlstls

Passive TLS handshake observer.

trackertracker

FlowTracker — a hashtable of live flows with a TCP state machine and idle-timeout sweep.

well_known

flowscope::well_known — curated port → protocol label table.

wireguardwireguard

WireGuard passive handshake / transport detection.

Structs

Error

The unified flowscope error type.

ErrorKind

Routing-and-context kind for an Error.

OwnedPacketView

An owned PacketView — frame bytes in a Vec<u8> plus timestamp and per-packet hardware metadata. Use as_view to get a borrowed PacketView<'_>.

PacketView

What a crate::FlowExtractor is given.

Timestamp

Nanosecond-precision kernel timestamp.

Enums

ErrorCode

Stable short identifier for matching in user code.

Module

Subsystem identifier for Error.

Traits

AsPacketView

One-method trait letting any owned-packet type produce a borrowed PacketView. Combined with track(impl Into<PacketView<'_>>), it lets foreign packet types be passed straight to tracker.track(&owned) / driver.track(&owned).

Type Aliases

Result

Result alias used throughout flowscope.