Module community_id 

Available on crate feature community-id only.

Community ID v1 flow hashing — the cross-tool standard for joining flows across Zeek, Suricata, Security Onion, Arkime and friends.

flowscope’s native stable_hash (FNV-1a, 64-bit) is fast and direction-invariant but flowscope-specific (non-portable). Community ID is the interoperable id and the canonical flow identifier in flowscope’s EVE / NDJSON output since 0.19 (issue #88): an analyst can take a community_id from a flowscope record and pivot directly into the SIEM’s existing Zeek/Suricata data. stable_hash is no longer emitted — keep it for in-process sharding / keying only.

Algorithm (spec v1)

SHA-1 over the byte string

seed(2, BE) ‖ a_ip ‖ b_ip ‖ proto(1) ‖ pad(1)=0 ‖ a_port(2, BE) ‖ b_port(2, BE)

where the endpoint pair is ordered canonically — (a_ip, a_port) is the lexicographically smaller of (src, sport) / (dst, dport) — so both directions of a flow produce the same id. The 20-byte digest is base64-encoded and prefixed with the version tag "1:".

Scope

TCP / UDP / SCTP are exact (this is the SIEM-pivot case). For ICMP and other port-less protocols, flowscope’s keys carry no ports (they are 0), so the spec’s ICMP type/code-as-ports special handling is not reproduced — the id is still stable and direction-invariant, but will not match a Zeek/Suricata ICMP Community ID. Documented limitation; revisit if a consumer needs ICMP parity.

Requires the community-id Cargo feature. The seed-fixed KeyFields::stable_hash / shard_index helpers are always-on and live in crate::anomaly_fields.

Issue #76.

Functions

community_id_for_key

Generic helper: compute the Community ID for any KeyFields. Returns None if the key lacks any of (protocol id, src/dest ip, src/dest port). Used by the EVE / NDJSON emit writers.

community_id_v1

Compute the Corelight Community ID v1 string for one flow tuple.