Struct FlowAnalyzer 

pub struct FlowAnalyzer<K>
where
    K: Hash + Eq,
{ /* private fields */ }

Available on crate feature analysis only.

Per-flow analysis accumulator. Generic over the flow key K.

Implementations

impl<K> FlowAnalyzer<K>

where K: Hash + Eq + Clone,

pub fn new(ttl: Duration) -> Self

New analyzer with unbounded per-flow state expired only by ttl (idle flows reclaimed by evict_expired). Prefer with_capacity in production.

pub fn with_capacity(ttl: Duration, capacity: usize) -> Self

New analyzer bounded to capacity concurrently-tracked flows (LRU eviction past the cap) plus the ttl idle expiry — the project’s bounded-memory contract.

pub fn with_ioc(self, ioc: IocSet) -> Self

Attach a threat-intel IocSet to screen flows against at finalize time (SNI / DNS qnames / IPs / JA3 / JA4). Without one, AnalyzedFlow::ioc_hits is always empty.

pub fn len(&self) -> usize

Number of flows with accumulated state.

pub fn is_empty(&self) -> bool

true if no flow state is held.

pub fn observe_tls(&mut self, key: &K, hs: &TlsHandshake, ts: Timestamp)

Available on crate feature tls only.

Fold a completed TLS handshake into the flow’s summary.

pub fn observe_http(&mut self, key: &K, msg: &HttpMessage, ts: Timestamp)

Available on crate feature http only.

Fold an HTTP message into the flow’s summary (requests only; see L7Summary::observe_http).

pub fn observe_dns_query(&mut self, key: &K, q: &DnsQuery, ts: Timestamp)

Available on crate feature dns only.

Record the query names from a DNS query.

pub fn observe_dns_response(&mut self, key: &K, r: &DnsResponse, ts: Timestamp)

Available on crate feature dns only.

Record the query names from a DNS response.

pub fn evict_expired(&mut self, now: Timestamp)

Reclaim per-flow state for flows idle longer than the TTL — call periodically (e.g. on a tracker tick) so flows that end without an explicit finalize don’t linger.

pub fn forget(&mut self, key: &K) -> bool

Drop a flow’s accumulated state without producing a record (e.g. a flow you decided not to analyze). Returns whether state was present.

impl<K> FlowAnalyzer<K>

where K: Hash + Eq + Clone + KeyFields,

pub fn finalize(&mut self, key: &K, stats: FlowStats) -> AnalyzedFlow<K>

Finalize a flow on its Ended event: take its accumulated L7Summary, compute the FlowRisk and IOC hits, evict the per-flow state, and return the enriched AnalyzedFlow. Idempotent — a second call for the same key sees an empty summary.

pub fn snapshot( &self, key: &K, now: Timestamp, stats: FlowStats, ) -> AnalyzedFlow<K>

Compute the AnalyzedFlow for a flow without evicting its state — a mid-flow snapshot at now. Use finalize on the terminal event.