Module event

Available on crate feature tracker only.

Expand description

Events emitted by crate::FlowTracker as packets flow through it.

Structs§

EventMask: Selects which FlowEvent variants a tracker should not emit — a source-level load-shedding knob (issue #79).
FlowStats: Aggregate counters maintained per flow.

AnomalyKind: Live, in-flight anomaly classifications. Carried by FlowEvent::FlowAnomaly / FlowEvent::TrackerAnomaly.
EndReason: Why a flow ended.
FlowEvent: Events emitted by the tracker.
FlowSide: Which side of a flow a packet belongs to — the logical role direction axis (who started the conversation).
FlowState: Lifecycle state of a flow as tracked by crate::FlowTracker.
MemcapPolicy: Tracker-wide memcap policy — what to do when the total reassembly buffering across all flows trips the configured memcap. Mirrors Suricata’s stream.reassembly.memcap-policy vocabulary, collapsed to the four behaviors that make sense for a passive analyzer.
OverflowPolicy: What to do when crate::BufferedReassembler’s in-flight buffer would exceed its configured cap.
Severity: Severity classification for AnomalyKind events. Returned by AnomalyKind::severity; consumers route anomalies on this enum (logs vs metrics vs alerts).
TcpOverlapPolicy: TCP overlap-resolution policy — which segment’s bytes win the overlap region when two TCP segments cover the same sequence range with different content.