Struct DatagramDriver 

pub struct DatagramDriver<E, F>
where
    E: FlowExtractor,
    F: DatagramParserFactory<E::Key>,
{ /* private fields */ }

Available on crate features extractors and reassembler and session only.

One DatagramParser type over a UDP capture, with an ordered SessionEvent output. The datagram sibling of SessionDriver; no reassembly is involved.

Implementations

impl<E, F, M> DatagramDriver<E, F>

where E: FlowExtractor, E::Key: Hash + Eq + Clone, F: DatagramParserFactory<E::Key>, F::Parser: DatagramParser<Message = M>,

pub fn new(extractor: E, factory: F) -> Self

Default config.

pub fn with_config(extractor: E, factory: F, config: FlowTrackerConfig) -> Self

Explicit config.

pub fn from_tracker(tracker: FlowTracker<E, ()>, factory: F) -> Self

Take over an existing flow table.

pub fn with_emit_anomalies(self, enable: bool) -> Self

Emit SessionEvent::FlowAnomaly / SessionEvent::TrackerAnomaly (reassembly gaps, overflows, retransmits, parser poison, eviction pressure, …). Default: off.

pub fn set_emit_anomalies(&mut self, enable: bool)

In-place variant of Self::with_emit_anomalies.

pub fn with_dedup(self, dedup: Dedup) -> Self

Drop duplicate packets (content hash) before tracking — see crate::Dedup. Applies to the flow table and to the parser alike. Read the counts back through Self::dedup, or watch flowscope_packets_deduplicated_total (metrics feature).

pub fn set_dedup(&mut self, dedup: Option<Dedup>)

In-place variant of Self::with_dedup; None removes it.

pub fn dedup(&self) -> Option<&Dedup>

Borrow the dedup state; None when none is configured. crate::Dedup::dropped / crate::Dedup::seen are the counts. New in 0.25.1.

pub fn with_monotonic_timestamps(self, enable: bool) -> Self

Clamp packet timestamps (and sweep times) to a running max so time never goes backwards. Default: off.

pub fn set_monotonic_timestamps(&mut self, enable: bool)

In-place variant of Self::with_monotonic_timestamps.

pub fn with_idle_timeout_fn<G>(self, f: G) -> Self

where G: Fn(&E::Key, Option<L4Proto>) -> Option<Duration> + Send + Sync + 'static,

Per-flow idle-timeout override (see FlowTracker::set_idle_timeout_fn). The parser’s life is bound to the flow’s, so this also decides when parser state is reset.

pub fn set_config(&mut self, config: FlowTrackerConfig)

Replace the config (tracker and reassembly limits alike).

pub fn config(&self) -> &FlowTrackerConfig

Current config.

pub fn tracker(&self) -> &FlowTracker<E, ()>

Borrow the flow table.

pub fn set_idle_timeout_fn<G>(&mut self, f: G)

where G: Fn(&E::Key, Option<L4Proto>) -> Option<Duration> + Send + Sync + 'static,

In-place variant of Self::with_idle_timeout_fn.

pub fn pause_events(&mut self)

Stop emitting lifecycle events (overload shunt); the parser keeps running and flows keep being released.

pub fn resume_events(&mut self)

Resume after Self::pause_events.

pub fn flow_driver(&self) -> &FlowDriver<E, SegmentBufferReassemblerFactory, ()>

Borrow the underlying flow driver (reassembly state, memcap accounting).

pub fn snapshot_flow_stats( &self, ) -> impl Iterator<Item = (E::Key, FlowStats)> + '_

Live (key, stats) of every tracked flow, reassembly diagnostics included.

pub fn flow_stats(&self, key: &E::Key) -> Option<FlowStats>

Live stats of one flow, reassembly diagnostics included.

pub fn track_into<'v>( &mut self, view: impl Into<PacketView<'v>>, out: &mut Vec<SessionEvent<E::Key, M>>, )

Track one packet, appending the resulting events to out.

pub fn track<'v>( &mut self, view: impl Into<PacketView<'v>>, ) -> Vec<SessionEvent<E::Key, M>>

Track one packet and return the resulting events.

pub fn sweep_into( &mut self, now: Timestamp, out: &mut Vec<SessionEvent<E::Key, M>>, )

Run the periodic hooks (on_tick, out-of-order hole deadlines) and end idle flows.

pub fn sweep(&mut self, now: Timestamp) -> Vec<SessionEvent<E::Key, M>>

Self::sweep_into returning a fresh Vec.

pub fn finish_into(&mut self, out: &mut Vec<SessionEvent<E::Key, M>>)

End of input: end every flow. Parsers’ on_tick sees Timestamp::MAX; output is stamped with the latest packet timestamp and the monotonic clock is left alone.

pub fn finish(&mut self) -> Vec<SessionEvent<E::Key, M>>

Self::finish_into returning a fresh Vec.

pub fn force_close_into( &mut self, key: &E::Key, now: Timestamp, out: &mut Vec<SessionEvent<E::Key, M>>, )

End one flow now (EndReason::ForceClosed): its last bytes reach the parser, which is flushed (fin_*) before the Closed. No-op for an unknown key.

pub fn force_close( &mut self, key: &E::Key, now: Timestamp, ) -> Vec<SessionEvent<E::Key, M>>

Self::force_close_into returning a fresh Vec.