Struct FlowDriver 

pub struct FlowDriver<E, F, S = ()>
where
    E: FlowExtractor,
    F: ReassemblerFactory<E::Key>,
    S: Send + 'static,
{ /* private fields */ }

Available on crate feature reassembler only.

Implementations

impl<E, F> FlowDriver<E, F, ()>

where E: FlowExtractor, F: ReassemblerFactory<E::Key>,

pub fn new(extractor: E, factory: F) -> Self

Construct with default config and S = () (no per-flow user state). Annotation-free.

pub fn with_config(extractor: E, factory: F, config: FlowTrackerConfig) -> Self

Construct with explicit config and S = ().

impl<E, F, S> FlowDriver<E, F, S>

where E: FlowExtractor, F: ReassemblerFactory<E::Key>, S: Default + Send + 'static,

pub fn with_state(extractor: E, factory: F) -> Self

Construct with default config and per-flow state initialised via S::default().

pub fn with_state_and_config( extractor: E, factory: F, config: FlowTrackerConfig, ) -> Self

Construct with explicit config and per-flow state initialised via S::default().

impl<E, F, S> FlowDriver<E, F, S>

where E: FlowExtractor, F: ReassemblerFactory<E::Key>, S: Send + 'static,

pub fn with_state_init<G>(extractor: E, factory: F, init: G) -> Self

where G: FnMut(&E::Key) -> S + Send + Sync + 'static,

Construct with default config and a custom per-flow state initialiser. Use when S isn’t Default or when state should be derived from the flow key.

pub fn with_state_init_and_config<G>( extractor: E, factory: F, config: FlowTrackerConfig, init: G, ) -> Self

where G: FnMut(&E::Key) -> S + Send + Sync + 'static,

Construct with explicit config and a custom per-flow state initialiser.

pub fn with_emit_anomalies(self, enable: bool) -> Self

Opt in to emitting FlowEvent::FlowAnomaly / FlowEvent::TrackerAnomaly for buffer overflows, out-of-order drops, and tracker eviction pressure. Default: false — no anomaly events emitted; counters still accumulate in crate::FlowStats.

Anomalies are coalesced per (flow, side, kind) per tick so a pathological flow doesn’t swamp the stream.

pub fn with_idle_timeout_fn<G>(self, f: G) -> Self

where G: Fn(&E::Key, Option<L4Proto>) -> Option<Duration> + Send + Sync + 'static,

Set a per-key idle-timeout override on the underlying tracker (see FlowTracker::set_idle_timeout_fn). Builder-style passthrough — chains nicely with Self::new / Self::with_config / Self::with_emit_anomalies.

pub fn with_dedup(self, dedup: Dedup) -> Self

Filter incoming PacketViews through a content-hash crate::Dedup before extraction. Views the dedup classifies as duplicates produce zero events. Useful for loopback captures (tcpdump -i lo) where every packet arrives twice via the kernel’s outgoing/host reinjection.

pub fn dedup(&self) -> Option<&Dedup>

Borrow the dedup state (e.g. for .dropped() / .buffered() stats). None when no dedup is configured.

pub fn with_monotonic_timestamps(self, enable: bool) -> Self

Opt in to strictly non-decreasing timestamps across the stream. Each packet’s view.timestamp is clamped to max(view.timestamp, last_emitted_timestamp).

Useful for downstream consumers that build timelines from FlowEvent and want a guarantee that successive events never go backwards in time. Default: off (raw NIC timestamps flow through unmodified). The clamp also applies to Self::sweep’s now argument.

pub fn track<'v>( &mut self, view: impl Into<PacketView<'v>>, ) -> FlowEvents<E::Key>

Process one packet. Drives the tracker and dispatches TCP payloads to the factory’s reassemblers. Reassemblers are created on demand and cleaned up on Ended.

pub fn track_pending<'v>( &mut self, view: impl Into<PacketView<'v>>, ) -> FlowEvents<E::Key>

Lower-level: process one packet and return events without finalizing reassemblers. Reassemblers remain accessible (via Self::reassembler / Self::drain_buffer) until Self::finalize is called.

You MUST call Self::finalize before the next track_pending / sweep_pending / track / sweep call — otherwise reassemblers for ended flows are never cleaned up. Typical use: the internal session engine calls track_pending, drains buffered bytes from reassemblers, then calls finalize.

pub fn sweep(&mut self, now: Timestamp) -> Vec<FlowEvent<E::Key>>

Run the idle-timeout sweep and clean up reassemblers for ended flows.

pub fn finish(&mut self) -> Vec<FlowEvent<E::Key>>

Sweep every remaining flow to its end. Call once after the last track when input is exhausted — equivalent to sweep(Timestamp::MAX). Every still-open flow is emitted as FlowEvent::Ended.

pub fn force_close( &mut self, key: &E::Key, now: Timestamp, ) -> Vec<FlowEvent<E::Key>>

Force-end the flow with this key. Driver-level mirror of FlowTracker::force_close. Tears down the per-(flow, side) reassembler slots before emitting the terminal event. New in 0.8.0.

Returns the resulting FlowEvents (one Ended for the closed flow plus any pending anomalies — same shape as track()). Empty if key was not active.

pub fn sweep_pending(&mut self, now: Timestamp) -> Vec<FlowEvent<E::Key>>

Lower-level sweep variant. Like Self::sweep but does NOT finalize ended flows’ reassemblers. See Self::track_pending for the contract.

pub fn finalize(&mut self, events: &mut [FlowEvent<E::Key>])

Patch reassembly diagnostics into every Ended event and drop the corresponding reassemblers (calling fin / rst). Called automatically by Self::track / Self::sweep; callers using Self::track_pending / Self::sweep_pending must call this before the next track* / sweep* call.

pub fn reassembly_memcap_bytes(&self) -> u64

Inspector for the cross-flow reassembly memcap accounting (issue #26). Returns the running total of bytes currently buffered across every live reassembler. Useful for dashboards and tests; the value mirrors what the AnomalyKind::GlobalMemcapHit bytes_in_flight field would report at the trip moment.

pub fn reassembler( &mut self, key: &E::Key, side: FlowSide, ) -> Option<&mut F::Reassembler>

Borrow the per-(flow, side) reassembler. Returns None when no reassembler exists (no TCP payload has been seen on that side, or the flow has already ended and been finalized).

Most useful between Self::track_pending and Self::finalize, where reassemblers for ended flows haven’t been dropped yet.

pub fn tracker(&self) -> &FlowTracker<E, S>

Borrow the inner tracker (for stats, introspection).

pub fn tracker_mut(&mut self) -> &mut FlowTracker<E, S>

Borrow the inner tracker mutably.

pub fn emits_anomalies(&self) -> bool

True when Self::with_emit_anomalies was called with true. Used by wrappers (e.g. the internal FlowSessionDriver engine) that need to mirror the same anomaly-emission policy.

pub fn snapshot_flow_stats( &self, ) -> impl Iterator<Item = (E::Key, FlowStats)> + '_

Iterate (key, FlowStats) for every live flow. Unlike crate::FlowTracker::all_flow_stats, this combines the tracker’s per-flow stats with live reassembler diagnostics (OOO drops, oversize-byte drops, peak watermark) so consumers get an up-to-date picture mid-flow.

Returns a lazy iterator. Each item clones the underlying crate::FlowStats (cheap — owned u64s + two Timestamps) and patches in the reassembler-derived fields. Collect with .collect::<Vec<_>>() if you need to hold the snapshot past further track() calls.

impl<E, S> FlowDriver<E, BufferedReassemblerFactory, S>

where E: FlowExtractor, S: Send + 'static,

pub fn drain_buffer(&mut self, key: &E::Key, side: FlowSide) -> Vec<u8>

Drain buffered bytes for the given (key, side) and return them as a Vec<u8>. Returns an empty Vec when no reassembler exists for that key/side or the buffer is empty.

Specialisation of Self::reassembler for the crate::BufferedReassemblerFactory case — calls crate::BufferedReassembler::take on the reassembler. Used by the internal session engine between track_pending and finalize to harvest payload bytes before ended-flow reassemblers are dropped.