Struct Driver 

pub struct Driver<E>
where
    E: FlowExtractor,
    E::Key: Hash + Eq + Clone + Send + Sync + 'static,
{ /* private fields */ }

Available on crate features extractors and reassembler and session only.

Plan 121 typed driver. Emits flow-lifecycle Event<K> only; per-parser typed messages flow through SlotHandle.

Driver<E> is Send + Sync since 0.13 — every field is structurally Send+Sync (Arc<SegQueue<_>> slot queues, owned FlowDriver, Vec<Box<dyn ErasedSlot<_> + Send + Sync>> slot list). Methods take &mut self, so the Sync impl is decorative — you can borrow the driver across threads, but only one caller mutates at a time. The headline use case is tokio::spawn(driver_task) on the default multi-thread runtime.

Implementations

impl<E> Driver<E>

where E: FlowExtractor + Clone + Send + 'static, E::Key: Hash + Eq + Clone + Send + Sync + 'static,

pub fn builder(extractor: E) -> DriverBuilder<E>

Begin building.

pub fn track<'v>( &mut self, view: impl Into<PacketView<'v>>, ) -> Vec<Event<E::Key>>

Process one packet. Returns the merged flow-lifecycle event stream. Typed parser messages don’t appear here — drain them via the SlotHandles returned at build time.

pub fn track_into<'v>( &mut self, view: impl Into<PacketView<'v>>, out: &mut Vec<Event<E::Key>>, )

Append-only variant of Self::track. Reuses out’s capacity — zero allocation at the surface in steady state.

pub fn sweep(&mut self, now: Timestamp) -> Vec<Event<E::Key>>

Periodic sweep. Drives idle-timeout Ended events

• each slot’s on_tick.

pub fn sweep_into(&mut self, now: Timestamp, out: &mut Vec<Event<E::Key>>)

Append-only sweep.

pub fn finish(&mut self) -> Vec<Event<E::Key>>

End-of-input flush.

pub fn finish_into(&mut self, out: &mut Vec<Event<E::Key>>)

Append-only finish.

pub fn run_pcap<P: AsRef<Path>>(self, path: P) -> Result<RunPcap<E>>

Available on crate feature pcap only.

One-call iterator over a pcap file — drives every packet through this driver and yields the lifecycle event stream. Per-parser typed messages still flow through the registered SlotHandles; drain them yourself between iterator pulls if you need them in-line.

This is the multi-parser sibling of the per-protocol *_from_pcap helpers (flowscope::http::requests_from_pcap, flowscope::dns::messages_from_pcap, etc.) — those work when one parser owns the whole walk; this works when you want HTTP + TLS + DNS slots on the same Driver and process the combined event stream in one pass.

use flowscope::driver::Driver;
use flowscope::extract::FiveTuple;
let mut builder = Driver::builder(FiveTuple::bidirectional());
let _http_slot = builder.session_on_ports(HttpParser::default(), [80]);
let driver = builder.build();
for ev in driver.run_pcap("trace.pcap")? {
    let _ev = ev?;
}

Issue #64 (0.18).

pub fn force_close( &mut self, key: &E::Key, now: Timestamp, ) -> Vec<Event<E::Key>>

Force-end the flow with this key. Mirror of crate::FlowTracker::force_close / crate::FlowDriver::force_close at the typed-driver layer.

Drains any reassembler-buffered bytes through each registered slot’s parser (one last feed_* + fin_* per side); typed messages flushed by the parser land in their slot handle, Event::ParserClosed events land in out, and a final Event::Ended with reason crate::EndReason::ForceClosed is emitted by the central tracker.

No-op if key is not currently tracked.

pub fn force_close_into( &mut self, key: &E::Key, now: Timestamp, out: &mut Vec<Event<E::Key>>, )

Append-only variant of Self::force_close. Reuses out’s capacity.

pub fn tracker(&self) -> &FlowTracker<E, ()>

Borrow the underlying tracker for introspection.

pub fn tracker_mut(&mut self) -> &mut FlowTracker<E, ()>

Mutable borrow of the underlying tracker.