Module tracker 

Available on crate feature tracker only.

FlowTracker — a hashtable of live flows with a TCP state machine and idle-timeout sweep.

FlowTracker<E, S> is generic over the flow extractor (E) and optional per-flow user state (S, defaults to ()). Drive it synchronously with FlowTracker::track for sync use, or use netring’s AsyncCapture::flow_stream adapter for tokio.

Structs

ActiveFlow

Snapshot of one live flow returned by FlowTracker::iter_active.

FlowEntry

Per-flow accounting + user state.

FlowTracker

Bidirectional flow tracker, generic over an extractor E and optional per-flow user state S.

FlowTrackerConfig

Tracker configuration. Defaults follow Suricata’s normal-mode values.

FlowTrackerStats

Tracker-level statistics (cumulative since construction).

Type Aliases

FlowEvents

Inline-stored set of events emitted by a single track() call. Most packets emit 1–2 events; pathological cases (Started + Established + Packet) emit 3.

IdleTimeoutFn

Per-key idle-timeout override predicate. Receives the flow’s key and (when extractable) the L4 protocol, returns Some(duration) to override the per-protocol default from FlowTrackerConfig, or None to fall through to the default.