Struct FilterConfig 

pub struct FilterConfig {

    pub negate: bool,
    pub rules: Vec<FilterRuleConfig>,
    pub proto: Vec<String>,
    pub src_ip: Vec<String>,
    pub dst_ip: Vec<String>,
    pub ip: Vec<String>,
    pub src_port: Vec<String>,
    pub dst_port: Vec<String>,
    pub port: Vec<String>,
    pub flow_id: Vec<String>,
    pub from: Option<String>,
    pub to: Option<String>,
    pub tcp_flags: Option<String>,
    pub min_len: Option<u32>,
    pub max_len: Option<u32>,
    pub unidirectional: bool,
    pub min_flow_packets: Option<u64>,
}

Filter configuration.

Fields

negate: bool

When true, the entire filter result is inverted.

rules: Vec<FilterRuleConfig>

Additional filter rules chained after the base body.

proto: Vec<String>

IP protocols to keep (e.g. ["tcp", "udp"]).

src_ip: Vec<String>

Source IP addresses / CIDRs to keep (OR-ed).

dst_ip: Vec<String>

Destination IP addresses / CIDRs to keep (OR-ed).

ip: Vec<String>

Either-endpoint IP addresses / CIDRs (OR-ed).

src_port: Vec<String>

Source port or range strings to keep (OR-ed).

dst_port: Vec<String>

Destination port or range strings to keep (OR-ed).

port: Vec<String>

Either-endpoint port or range strings (OR-ed).

flow_id: Vec<String>

Hex flow IDs to retain (comma-separated or multiple entries).

from: Option<String>

Retain only packets at or after this datetime (RFC 3339 or Unix epoch seconds).

to: Option<String>

Retain only packets at or before this datetime (RFC 3339 or Unix epoch seconds).

tcp_flags: Option<String>

TCP flags filter string (e.g. "SYN+ACK", "RST:exact").

min_len: Option<u32>

Minimum captured packet length in bytes.

max_len: Option<u32>

Maximum captured packet length in bytes.

unidirectional: bool

Use unidirectional flow IDs (default: bidirectional).

min_flow_packets: Option<u64>

Only include flows with at least this many packets. Non-IP packets are excluded when this filter is active.

Trait Implementations

impl Debug for FilterConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for FilterConfig

fn default() -> FilterConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for FilterConfig

fn deserialize(value: &mut Value<'de>) -> Result<Self, DeserError>

Given a mutable Value, allows you to deserialize the type from it, or accumulate 1 or more errors