Struct HostPair 

pub struct HostPair {
    pub src: IpAddr,
    pub dst: IpAddr,
    pub dst_port: Option<u16>,
}

Available on crate feature tracker only.

(src, dst, dst_port) aggregation key — the beaconing axis: each beacon ping is its own 5-tuple (ephemeral source port), so beacon detectors must aggregate across flows on the host-pair, not the flow key.

Fields

src: IpAddr

dst: IpAddr

dst_port: Option<u16>

Destination port, when the flow key exposes one. Kept in the key so beacons to distinct services score separately.

Implementations

impl HostPair

pub fn from_key<K: KeyFields + ?Sized>(key: &K) -> Option<Self>

Derive from any KeyFields flow key; None unless the key exposes both IPs.

Trait Implementations

impl Clone for HostPair

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for HostPair

impl Debug for HostPair

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for HostPair

impl Hash for HostPair

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl KeyFields for HostPair

fn src_ip(&self) -> Option<IpAddr>

Source IP for the flow.

fn dest_ip(&self) -> Option<IpAddr>

Destination IP for the flow.

fn dest_port(&self) -> Option<u16>

Destination port (TCP/UDP).

fn src_port(&self) -> Option<u16>

Source port (TCP/UDP).

fn proto_str(&self) -> Option<&'static str>

L4 protocol as a static EVE-compatible label ("TCP" / "UDP" / "ICMP" / "ICMPv6" / "SCTP").

fn protocol_identifier(&self) -> Option<u8>

L4 protocol number per IANA assigned numbers (TCP=6, UDP=17, ICMP=1, ICMPv6=58, SCTP=132). Used by IPFIX-IE-keyed exporters that need the numeric ID alongside the Self::proto_str label. Default None — override on keys that carry an L4 protocol.

fn app_proto_str(&self) -> Option<&'static str>

Application-layer protocol label, e.g. "http" / "dns" / "tls". Default None — emit writers typically thread the parser_kind from crate::driver::SlotMessage instead. Override only on custom keys that carry app-layer hints natively.

fn stable_hash(&self) -> Option<u64>

Stable, seed-fixed 64-bit hash over the canonical (direction-normalized) 5-tuple.

fn shard_index(&self, n: usize) -> Option<usize>

Deterministic shard index in 0..n for sharded flow tables. None if n == 0 or the key lacks a full 5-tuple.

fn community_id(&self) -> Option<String>

Corelight Community ID v1 with the universal default seed (0) — the cross-tool flow id for pivoting flowscope output against Zeek / Suricata / Security Onion.

fn community_id_seeded(&self, seed: u16) -> Option<String>

Self::community_id with an explicit sensor seed.

impl PartialEq for HostPair

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for HostPair