Struct RouterScopedParser

Source

pub struct RouterScopedParser<K: Hash + Eq> { /* private fields */ }

Expand description

A parser that maintains separate template caches for each NetFlow source.

This is the recommended pattern for multi-source deployments where different routers may use the same template IDs for different field definitions. By keeping separate parser instances per source, templates are properly isolated.

Uses an LRU cache internally for O(1) eviction of the least-recently-used source when at capacity, preventing DoS attacks via source address flooding.

§Type Parameter

K - The key type used to identify sources. Commonly SocketAddr for UDP sources, but can be any hashable type (e.g., String for named sources, u32 for observation domain IDs, etc.)

§Examples

§Basic usage with SocketAddr

use netflow_parser::RouterScopedParser;
use std::net::SocketAddr;

let mut scoped_parser = RouterScopedParser::<SocketAddr>::new();

// Parse packet from source 1
let source1 = "192.168.1.1:2055".parse().unwrap();
let data1 = vec![/* netflow data */];
let packets = scoped_parser.parse_from_source(source1, &data1);

// Parse packet from source 2 (separate template cache)
let source2 = "192.168.1.2:2055".parse().unwrap();
let data2 = vec![/* netflow data */];
let packets = scoped_parser.parse_from_source(source2, &data2);

§Custom source keys

use netflow_parser::RouterScopedParser;

// Use string identifiers for sources
let mut scoped_parser = RouterScopedParser::<String>::new();

let packets = scoped_parser.parse_from_source(
    "router-nyc-01".to_string(),
    &data
);

Implementations§

Source §

impl<K: Hash + Eq> RouterScopedParser<K>

Source

pub fn new() -> Self

Create a new scoped parser with default configuration.

Each new source will get a parser with default settings.

Source

pub fn try_with_builder( builder: NetflowParserBuilder, ) -> Result<Self, ConfigError>

Create a new scoped parser with a custom parser builder.

Validates the builder configuration eagerly. Returns an error if the builder configuration is invalid (e.g., zero cache size).

§Errors

Returns ConfigError if the builder configuration is invalid.

§Examples

use netflow_parser::{RouterScopedParser, NetflowParser};
use netflow_parser::variable_versions::ttl::TtlConfig;
use std::time::Duration;
use std::net::SocketAddr;

let builder = NetflowParser::builder()
    .with_cache_size(5000)
    .with_ttl(TtlConfig::new(Duration::from_secs(3600)));

let scoped_parser = RouterScopedParser::<SocketAddr>::try_with_builder(builder)
    .expect("valid config");

Source

pub fn with_max_sources(self, max: usize) -> Result<Self, ConfigError>

Set the maximum number of sources to track.

When at capacity and a new source arrives, the least-recently-used source is automatically evicted to make room. Default: 10,000.

§Errors

Returns ConfigError::InvalidMaxSources if max is 0.

Source

pub fn with_max_sources_and_reporter<F>( self, max: usize, reporter: &mut F, ) -> Result<Self, ConfigError>
where F: FnMut(&SourceRemoval<K>) -> Result<(), SourceRemovalReporterError>,

Set the maximum number of sources and report every source removed by reducing the capacity.

Reporting completes synchronously before this method returns. Reporter errors and panics are isolated and counted in source_removal_metrics.

§Errors

Returns ConfigError::InvalidMaxSources if max is 0.

Source

pub fn parse_from_source(&mut self, source: K, data: &[u8]) -> ParseResult
where K: Clone,

Parse NetFlow data from a specific source.

This will automatically create a new parser instance for new sources, or reuse the existing parser for known sources. When at capacity, the least-recently-used source is automatically evicted by the LRU cache.