Struct NetworkFlowEvent 

#[repr(C)]
pub struct NetworkFlowEvent {
    pub timestamp_ns: u64,
    pub cgroup_id: u64,
    pub src_ip: u32,
    pub dst_ip: u32,
    pub src_port: u16,
    pub dst_port: u16,
    pub protocol: u8,
    pub direction: u8,
    pub packet_len: u16,
}

Network flow event with full 5-tuple and container identification

Layout (32 bytes total, 8-byte aligned):

• timestamp_ns: Kernel timestamp in nanoseconds
• cgroup_id: Container cgroup ID for pod correlation (0 for TC classifiers)
• src_ip: Source IPv4 address (first octet in LSB, as read from TC classifier)
• dst_ip: Destination IPv4 address (first octet in LSB, as read from TC classifier)
• src_port: Source port (host byte order)
• dst_port: Destination port (host byte order)
• protocol: IP protocol (6=TCP, 17=UDP, 1=ICMP)
• direction: Traffic direction (0=ingress, 1=egress)
• packet_len: Packet size in bytes

Note: IP addresses are stored with first octet in LSB position. For example, 10.0.0.5 is stored as 0x0500000A. Use from_le_bytes when parsing IP strings.

Fields

timestamp_ns: u64

cgroup_id: u64

src_ip: u32

dst_ip: u32

src_port: u16

dst_port: u16

protocol: u8

direction: u8

packet_len: u16

Trait Implementations

impl Clone for NetworkFlowEvent

fn clone(&self) -> NetworkFlowEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkFlowEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for NetworkFlowEvent

fn eq(&self, other: &NetworkFlowEvent) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for NetworkFlowEvent

impl Eq for NetworkFlowEvent

impl StructuralPartialEq for NetworkFlowEvent