Module session 

Available on crate feature session only.

Pluggable L7 message parsers.

Two trait families:

• SessionParser — for stream-based protocols (HTTP/1, TLS, DNS-over-TCP). One parser per session; receives bytes via feed_initiator / feed_responder; returns a Vec of typed messages every call. Pair with netring::SessionStream to get an async stream of L7 events.

• DatagramParser — for packet-based protocols (DNS-over-UDP, syslog, NTP, SNMP). Receives one L4 payload at a time. Pair with netring::DatagramStream.

Both trait shapes return owned Vec<Message> rather than borrowed iterators or SmallVec to keep the public API stable across versions of smallvec etc. The per-call allocation is amortized across many bytes worth of work.

SessionParser vs Reassembler

crate::Reassembler is the lower-level hook: one instance per (flow, side), receives raw TCP segments, callback-driven via a user-supplied handler. SessionParser is the higher-level abstraction: one instance per flow, two feed_* methods, returns typed messages directly. Pick whichever fits your integration:

Concern	Reassembler	SessionParser
Granularity	per (flow, side)	per flow
Output	callback (Handler)	iterator/Stream of messages
Cross-direction state	painful	natural
UDP support	no	use DatagramParser

Example

use flowscope::{FlowSide, SessionParser};

#[derive(Default, Clone)]
struct LineParser {
    init_buf: Vec<u8>,
    resp_buf: Vec<u8>,
}

impl SessionParser for LineParser {
    type Message = (FlowSide, String);

    fn feed_initiator(&mut self, bytes: &[u8]) -> Vec<Self::Message> {
        feed(&mut self.init_buf, bytes, FlowSide::Initiator)
    }
    fn feed_responder(&mut self, bytes: &[u8]) -> Vec<Self::Message> {
        feed(&mut self.resp_buf, bytes, FlowSide::Responder)
    }
}

fn feed(buf: &mut Vec<u8>, bytes: &[u8], side: FlowSide) -> Vec<(FlowSide, String)> {
    buf.extend_from_slice(bytes);
    let mut out = Vec::new();
    while let Some(nl) = buf.iter().position(|&b| b == b'\n') {
        let line = String::from_utf8_lossy(&buf[..nl]).into_owned();
        out.push((side, line));
        buf.drain(..=nl);
    }
    out
}

Enums

SessionEvent

Output of a SessionParser or DatagramParser-backed stream.

Traits

DatagramParser

Parses a packet-oriented L7 protocol. One instance per flow; receives one L4 payload at a time along with which side sent it.

DatagramParserFactory

Builds a fresh DatagramParser per session.

SessionParser

Parses a stream-oriented L7 protocol session. One instance per flow; both directions feed through the same parser, allowing state to interleave.

SessionParserFactory

Builds a fresh SessionParser per session. Modeled on crate::ReassemblerFactory.