Skip to main content

extract_flows

Function extract_flows 

Source
pub fn extract_flows(
    packets: &[CapturedPacket],
) -> Result<Vec<ConversationState>, FlowError>
Expand description

Extract bidirectional conversations from a list of captured packets.

This is the primary entry point for flow extraction. It processes all packets sequentially, groups them into bidirectional conversations using canonical key normalization, tracks TCP connection state and performs stream reassembly, and tracks UDP pseudo-conversations via timeouts.

Returns conversations sorted by start time.