Enum Event 

#[non_exhaustive]
pub enum Event<K> {
    Started {
        key: K,
        orientation: Orientation,
        ts: Timestamp,
        l4: Option<L4Proto>,
    },
    Established {
        key: K,
        ts: Timestamp,
        l4: Option<L4Proto>,
    },
    StateChange {
        key: K,
        from: FlowState,
        to: FlowState,
        ts: Timestamp,
    },
    #[non_exhaustive]
    Packet {
        key: K,
        side: FlowSide,
        orientation: Orientation,
        len: usize,
        ts: Timestamp,
        tcp: Option<TcpInfo>,
        source_idx: Option<u32>,
    },
    Ended {
        key: K,
        reason: EndReason,
        stats: FlowStats,
        history: HistoryString,
        l4: Option<L4Proto>,
        ts: Timestamp,
    },
    Tick {
        key: K,
        stats: FlowStats,
        ts: Timestamp,
    },
    ParserClosed {
        key: K,
        parser_kind: ParserKind,
        reason: EndReason,
        ts: Timestamp,
    },
    FlowAnomaly {
        key: K,
        kind: AnomalyKind,
        ts: Timestamp,
    },
    TrackerAnomaly {
        kind: AnomalyKind,
        ts: Timestamp,
    },
}

Available on crate features extractors and reassembler and session only.

Flow-lifecycle event type for the typed driver.

Plan 121: no M parameter, no Message variant — per-parser typed messages flow through SlotHandle returned by the builder. ParserClosed stays as a lifecycle marker for when a parser self-terminates.

Serializeable under the serde feature with the same tag = "type" / snake_case shape as FlowEvent, and convertible from it via Event::from(flow_event) (issue #97). The conversion is lossless — FlowEvent::StateChange maps to Self::StateChange.

Since 0.20 (#110) the variants share FlowEvent’s names (no redundant Flow prefix), so the two enums also serialize to the same type tags ("started", "established", "ended", …).

Serialize only (not Deserialize): the driver only ever emits events, so only the serialize half is derived. To read events back, deserialize the tracker primitive FlowEvent (which is round-trippable) and Event::from it.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Started

First packet of a new flow.

orientation is the flow’s deterministic canonical direction (Orientation, issue #118) — equal to the initiator’s orientation and to FlowStats::initiator_orientation.

Fields

key: K

orientation: Orientation

Canonical (address-sorted) orientation of the flow’s first packet. Deterministic regardless of arrival order.

ts: Timestamp

l4: Option<L4Proto>

Established

TCP flow reached the Established state (3-way handshake complete). Not emitted for UDP / ICMP flows.

Fields

key: K

ts: Timestamp

l4: Option<L4Proto>

StateChange

TCP state-machine transition other than reaching Established (e.g. Established → FinWait). The lossless counterpart of FlowEvent::StateChange (issue #97).

The typed Driver<E> does not emit this today — Established covers the common case and the driver historically omits raw state churn — but the variant exists so Event::from(FlowEvent::StateChange { .. }) is lossless and so future driver modes can surface it.

Fields

key: K

from: FlowState

to: FlowState

ts: Timestamp

#[non_exhaustive]

Packet

Per-packet event on an existing flow.

Per-packet TCP details

The tcp field is always None unless the driver was built with DriverBuilder::emit_packet_details(true) — that’s an opt-in, off by default to avoid per-packet extractor re-parse cost. Reading tcp on a default- configured driver and getting None is expected, not a bug. Use the convenience accessor Event::tcp when you want “tcp info if available, on any variant” without destructuring. The variant is #[non_exhaustive] (0.21, issue #121) — future per-packet enrichments are additive. Construct synthetic packets via flowscope::test_helpers::events::driver::packet*; match with a trailing ...

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

key: K

side: FlowSide

orientation: Orientation

Canonical (address-sorted) orientation of this packet (Orientation, issue #118). Together with the flow’s FlowStats::initiator_orientation it recovers side deterministically.

len: usize

ts: Timestamp

tcp: Option<TcpInfo>

source_idx: Option<u32>

Physical capture leg this packet arrived on (issue #121). Opt-in via DriverBuilder::emit_packet_source_idx — always None otherwise; None also for the 0 “unused” sentinel. See crate::FlowEvent::Packet’s field docs for the audit-tier vs per-direction-binding distinction.

Ended

Flow ended (FIN / RST / idle / eviction / parser close).

Fields

key: K

reason: EndReason

stats: FlowStats

history: HistoryString

l4: Option<L4Proto>

ts: Timestamp

Tick

Periodic FlowStats snapshot — emitted when crate::FlowTrackerConfig::flow_tick_interval is set.

Fields

key: K

stats: FlowStats

ts: Timestamp

ParserClosed

Parser-level close — a registered parser drained its fin_* accumulator or reported is_done / is_poisoned. Distinct from Self::Ended: this fires per (parser, flow); the flow may still be alive.

Fields

key: K

parser_kind: ParserKind

reason: EndReason

ts: Timestamp

FlowAnomaly

Live per-flow anomaly forwarded from the central tracker. Emitted only when emit_anomalies(true) was set.

Fields

key: K

kind: AnomalyKind

ts: Timestamp

TrackerAnomaly

Live tracker-global anomaly.

Fields

kind: AnomalyKind

ts: Timestamp

Implementations

impl<K> Event<K>

pub fn key(&self) -> Option<&K>

Borrow the flow key, if the variant has one.

pub fn tcp(&self) -> Option<&TcpInfo>

Per-packet TCP details, when available.

Returns the tcp field for Self::Packet events; None for every other variant. The field itself is only populated when the driver was built with DriverBuilder::emit_packet_details(true); if you haven’t opted in, this accessor (like the field) always returns None.

Useful for cross-variant pipelines that want “tcp info if the event carries any, otherwise None” without an explicit destructuring match arm on Packet.

pub fn timestamp(&self) -> Timestamp

Borrow the timestamp on the event.

pub fn into_flow_event(self) -> Option<FlowEvent<K>>

Project this typed event back to a tracker FlowEvent, if it has one (issue #97).

Returns None for Self::ParserClosed — a parser-level marker with no tracker-event counterpart. The Self::Packet tcp enrichment is dropped (FlowEvent carries no per-packet TCP details) and Self::Ended’s explicit ts is folded back into stats.last_seen.

This is the bridge that lets the emit writers — which speak FlowEvent — consume a typed Driver<E> stream. See crate::emit for the write_event-over-Event path.

pub fn to_flow_event(&self) -> Option<FlowEvent<K>>

where K: Clone,

Borrowing variant of Self::into_flow_event — clones the key/stats. Convenient for emit writers that take &FlowEvent<K> without consuming the event.

Trait Implementations

impl<K: Clone> Clone for Event<K>

fn clone(&self) -> Event<K>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<K: Debug> Debug for Event<K>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<K> From<FlowEvent<K>> for Event<K>

fn from(ev: FlowEvent<K>) -> Self

Lossless conversion from the tracker primitive to the typed driver event (issue #97).

Every FlowEvent variant has an Event counterpart: StateChange maps to Event::StateChange, Ended’s timestamp is taken from stats.last_seen, and Event::Packet’s tcp enrichment defaults to None (it is a driver-only, opt-in field — populate it via the driver’s emit_packet_details, not this conversion).

impl<K: Clone> LifecycleEvent<K> for Event<K>

Available on crate feature emit only.

fn as_flow_event(&self) -> Option<Cow<'_, FlowEvent<K>>>

Borrow (or produce) this event’s FlowEvent projection, or None if it has none.

impl<K> Serialize for Event<K>

where K: Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.