Struct TrackedEntry 

pub struct TrackedEntry {
    pub entry: PortEntry,
    pub status: EntryStatus,
    pub seen_at: Instant,
    pub first_seen: Option<Instant>,
    pub suspicious: Vec<SuspiciousReason>,
    pub container_name: Option<String>,
    pub service_name: Option<String>,
}

A PortEntry with change-tracking metadata and enrichment data.

The status field indicates whether the entry is new, unchanged, or gone since the last scan. seen_at records when the status was last updated.

Enrichment fields (first_seen, suspicious, container_name, service_name) are populated lazily by the corresponding modules after the diff step. They use Option / Vec to be zero-cost when the corresponding feature is not active.

Fields

entry: PortEntry

The underlying port entry.

status: EntryStatus

Current change status.

seen_at: Instant

When this status was assigned.

first_seen: Option<Instant>

When this connection was first observed (carried forward across scan cycles for Unchanged entries). Used for connection aging.

suspicious: Vec<SuspiciousReason>

Suspicious activity reasons detected by heuristics.

container_name: Option<String>

Docker/Podman container name, if the process runs inside one.

service_name: Option<String>

Well-known service name for the port (e.g. “http”, “ssh”).

Trait Implementations

impl Clone for TrackedEntry

fn clone(&self) -> TrackedEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrackedEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.