Struct TcpObservation 

pub struct TcpObservation {
    pub version: IpVersion,
    pub ittl: Ttl,
    pub olen: u8,
    pub mss: Option<u16>,
    pub wsize: WindowSize,
    pub wscale: Option<u8>,
    pub olayout: Vec<TcpOption>,
    pub quirks: Vec<Quirk>,
    pub pclass: PayloadSize,
}

Represents observed TCP characteristics from network traffic.

Fields

version: IpVersion

IP version

ittl: Ttl

initial TTL used by the OS.

olen: u8

length of IPv4 options or IPv6 extension headers.

mss: Option<u16>

maximum segment size, if specified in TCP options.

wsize: WindowSize

window size.

wscale: Option<u8>

window scaling factor, if specified in TCP options.

olayout: Vec<TcpOption>

layout and ordering of TCP options, if any.

quirks: Vec<Quirk>

properties and quirks observed in IP or TCP headers.

pclass: PayloadSize

payload size classification

Trait Implementations

impl Clone for TcpObservation

fn clone(&self) -> TcpObservation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl DatabaseSignature<TcpObservation> for Signature

fn get_quality_score(&self, distance: u32) -> f32

Returns the quality score based on the distance.

The score is a value between 0.0 and 1.0, where 1.0 is a perfect match.

The score is calculated based on the distance of the observed signal to the database signature. The distance is a value between 0 and 18, where 0 is a perfect match and 18 is the maximum possible distance.

fn calculate_distance(&self, observed: &TcpObservation) -> Option<u32>

Calculates a distance or dissimilarity score. Lower is better.

fn generate_index_keys_for_db_entry(&self) -> Vec<TcpIndexKey>

Generates index keys from this database signature. It’s a Vec because some DB signatures (like IpVersion::Any) might map to multiple keys. The OptionOF::Key in the Vec allows for cases where a specific DB sig might not produce a key for a certain specific version (e.g. an IpVersion::Any sig, when asked to produce a V4 key, will).

impl Debug for TcpObservation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for TcpObservation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ObservedFingerprint for TcpObservation

type Key = TcpIndexKey

The type of key used to index database signatures compatible with this observed fingerprint.

fn generate_index_key(&self) -> Self::Key

Generates an index key from this observed fingerprint.

impl PartialEq for TcpObservation

fn eq(&self, other: &TcpObservation) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for TcpObservation