Crate flowscope 

flowscope — passive flow & session tracking for packet capture.

Cross-platform, runtime-free library for observing what’s happening on the wire. Pair with any source of &[u8] frames: netring (Linux AF_PACKET / AF_XDP), pcap files, tun-tap, eBPF, embedded.

What’s here

Core (always on):

• PacketView / Timestamp — the abstract input.
• FlowExtractor — turn a frame into a flow descriptor.
• FlowTracker — bidirectional flow accounting + TCP state machine + idle/eviction policy. Hot-cache fast path on monoflow workloads.
• Reassembler — sync per-(flow, side) TCP byte stream hook. Optional per-side buffer cap with OverflowPolicy (sliding-window or drop-flow).
• SessionParser / DatagramParser — typed L7 message parsing per flow.
• FlowDriver — sync wrapper combining the tracker with a reassembler factory; optional anomaly emission via FlowDriver::with_emit_anomalies.
• FlowSessionDriver — sync mirror of netring’s session_stream for offline / no-tokio session-event consumers.

Built-in extractors and decap combinators (extractors feature):

• extract::FiveTuple, extract::IpPair, extract::MacPair
• extract::StripVlan, extract::StripMpls, extract::InnerVxlan, extract::InnerGtpU, extract::InnerGre, extract::AutoDetectEncap, extract::FlowLabel

Protocol parsers (each behind its own feature):

Feature	Module	What you get
http	http	HTTP/1.x request/response parser
tls	tls	TLS handshake observer (ClientHello/ServerHello/Alert), optional JA3
dns	dns	DNS-over-UDP and DNS-over-TCP message parsers + query/response correlator
pcap	pcap	pcap file source for offline replay

Observability (each behind its own feature, zero-cost when off):

Feature	What you get
metrics	Prometheus / OpenTelemetry counters, gauges, histograms (see obs)
tracing	Structured events on flow lifecycle + anomalies

Tokio integration

For async iteration over flow / session / datagram events, see netring’s AsyncCapture::flow_stream / .session_stream / .datagram_stream. Those depend on this crate’s traits. The sync analogue for session_stream is FlowSessionDriver.

Re-exporting flowscope types

Crates that re-export flowscope types (netring, sister crates, internal forks) should write intra-doc links in the bare [`FlowSessionDriver`] form, not the explicit [`FlowSessionDriver`](flowscope::FlowSessionDriver) form. The explicit path duplicates what rustdoc already resolves through the re-export and trips the redundant_explicit_links lint under -D warnings. See recipes.md’s “Re-exporting flowscope types” section for the worked example.

Re-exports

pub use anomaly::DetectorScore;tracker

pub use anomaly::OwnedAnomaly;tracker

pub use segment_reassembler::SegmentBufferReassembler;reassembler

pub use dedup::Dedup;tracker

pub use anomaly_fields::AnomalyFields;

pub use anomaly_fields::KeyFields;

pub use extractor::Extracted;

pub use extractor::FlowExtractor;

pub use extractor::L4Proto;

pub use extractor::Orientation;

pub use extractor::TcpFlags;

pub use extractor::TcpInfo;

pub use event::AnomalyKind;tracker

pub use event::EndReason;tracker

pub use event::FlowEvent;tracker

pub use event::FlowSide;tracker

pub use event::FlowState;tracker

pub use event::FlowStats;tracker

pub use event::OverflowPolicy;tracker

pub use history::HistoryString;tracker

pub use tracker::FlowEntry;tracker

pub use tracker::FlowEvents;tracker

pub use tracker::FlowTracker;tracker

pub use tracker::FlowTrackerConfig;tracker

pub use tracker::FlowTrackerStats;tracker

pub use flow_driver::FlowDriver;reassembler

pub use reassembler::BufferedReassembler;reassembler

pub use reassembler::BufferedReassemblerFactory;reassembler

pub use reassembler::NoopReassembler;reassembler

pub use reassembler::NoopReassemblerFactory;reassembler

pub use reassembler::Reassembler;reassembler

pub use reassembler::ReassemblerFactory;reassembler

pub use session::AccumulatingSessionParser;session

pub use session::BufferedFrameDrain;session

pub use session::DatagramParser;session

pub use session::DatagramParserFactory;session

pub use session::FrameDrainError;session

pub use session::PerDatagramParser;session

pub use session::SessionEvent;session

pub use session::SessionParser;session

pub use session::SessionParserFactory;session

pub use session_driver::FlowSessionDriver;reassembler and session

pub use datagram_driver::FlowDatagramDriver;extractors and reassembler and session

Modules

aggregateaggregate

flowscope::aggregate — distribution / quantile primitives.

anomalytracker

Canonical owned anomaly value type for detector-shaped emission and retention.

anomaly_fields

KeyFields + AnomalyFields — structured field access for emit writers (EVE, NDJSON, CSV, Zeek, custom).

correlatetracker

flowscope::correlate — generic helpers for cross-flow correlation patterns.

datagram_driverextractors and reassembler and session

Sync companion to netring’s async datagram_stream. Wraps a FlowDriver (with a no-op reassembler factory) and adds per-flow DatagramParser dispatch.

deduptracker

Content-hash deduplication of packet views.

detect

flowscope::detect — lightweight detection primitives.

dnsdns

Passive DNS parsing (UDP/53).

driverextractors and reassembler and session

flowscope::driver — the typed Driver<E> + SlotHandle<M, K> shape (plan 121).

emitemit

flowscope::emit — structured event sinks.

eventtracker

Events emitted by crate::FlowTracker as packets flow through it.

extractextractors

Built-in flow extractors and decap combinators.

extractor

FlowExtractor trait and its supporting types.

flow_driverreassembler

FlowDriver — sync wrapper that bundles a FlowTracker with a ReassemblerFactory and dispatches TCP segments to the right reassembler.

historytracker

Compact lifecycle representation à la Zeek’s conn.log history.

httphttp

Passive HTTP/1.x observer.

icmpicmp

Passive ICMPv4 / ICMPv6 message parsing (plan 76).

layersextractors

flowscope::layers — per-packet layered field access.

obstracker

Observability hooks — metrics counters and tracing events.

parser_kinds

Re-export of every shipped parser-kind constant under one path.

pcappcap

pcap file source for offline replay.

prelude

use flowscope::prelude::*; — one import for the common types.

reassemblerreassembler

Sync TCP reassembly hooks.

segment_reassemblerreassembler

SegmentBufferReassembler — TCP reassembler with out-of-order hole-fill.

sessionsession

Pluggable L7 message parsers.

session_driverreassembler and session

Sync companion to netring’s async session_stream. Wraps a FlowDriver and adds per-flow SessionParser dispatch, yielding SessionEvents.

tcp_statetracker and (test-helpers)

TCP state machine used internally by crate::FlowTracker.

test_helperssession and (test-helpers)

Parser stubs for downstream test crates. Gated by the test-helpers feature; not for production use. Parser stubs intended for downstream test crates that need a SessionParser / DatagramParser impl but don’t care about the produced messages.

tlstls

Passive TLS handshake observer.

trackertracker

FlowTracker — a hashtable of live flows with a TCP state machine and idle-timeout sweep.

well_known

flowscope::well_known — curated port → protocol label table.

Structs

Error

The unified flowscope error type.

ErrorKind

Routing-and-context kind for an Error.

OwnedPacketView

An owned PacketView — frame bytes in a Vec<u8> plus timestamp. Use as_view to get a borrowed PacketView<'_>.

PacketView

What a crate::FlowExtractor is given.

Timestamp

Nanosecond-precision kernel timestamp.

Enums

ErrorCode

Stable short identifier for matching in user code.

Module

Subsystem identifier for Error.

Traits

AsPacketView

One-method trait letting any owned-packet type produce a borrowed PacketView. Combined with track(impl Into<PacketView<'_>>), it lets foreign packet types be passed straight to tracker.track(&owned) / driver.track(&owned).

Type Aliases

Result

Result alias used throughout flowscope.