common

package

v0.0.0-...-50ddb51 Latest Latest Go to latest Published: Oct 24, 2025 License: Apache-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DataDog/datadog-agent

Links

Open Source Insights

Documentation ¶

Overview ¶

Package common provides a flow type and a few standard helpers.

Index ¶

Constants
Variables
func IsEqualFlowContext(a Flow, b Flow) bool
func Max[T cmp.Ordered](a T, b T) T
func Min[T cmp.Ordered](a T, b T) T
type AdditionalFields
type EndianType
type FieldType
type Flow
- func (f *Flow) AggregationHash() uint64
type FlowMessageWithAdditionalFields
type FlowType
- func GetAllFlowTypes() []FlowType
type FlowTypeDetail
- func GetFlowTypeByName(name FlowType) (FlowTypeDetail, error)
- func (f FlowTypeDetail) DefaultPort() uint16
- func (f FlowTypeDetail) Name() FlowType

Constants ¶

View Source

const (
	// DefaultStopTimeout is the default stop timeout in seconds
	DefaultStopTimeout = 5

	// DefaultAggregatorFlushInterval is the default flush interval in seconds
	DefaultAggregatorFlushInterval = 300 // 5min

	// DefaultAggregatorBufferSize is the default aggregator buffer size interval
	DefaultAggregatorBufferSize = 10000

	// DefaultAggregatorPortRollupThreshold is the default aggregator port rollup threshold
	DefaultAggregatorPortRollupThreshold = 10

	// DefaultAggregatorRollupTrackerRefreshInterval is the default aggregator rollup tracker refresh interval
	DefaultAggregatorRollupTrackerRefreshInterval = 300 // 5min

	// DefaultBindHost is the default bind host used for flow listeners
	DefaultBindHost = "0.0.0.0"

	// DefaultPrometheusListenerAddress is the default goflow prometheus listener address
	DefaultPrometheusListenerAddress = "localhost:9090"
)

Variables ¶

View Source

var FlowTypeDetails = map[FlowType]FlowTypeDetail{
	TypeIPFIX: {
		// contains filtered or unexported fields
	},
	TypeSFlow5: {
		// contains filtered or unexported fields
	},
	TypeNetFlow5: {
		// contains filtered or unexported fields
	},
	TypeNetFlow9: {
		// contains filtered or unexported fields
	},
}

FlowTypeDetails contain list of valid FlowTypeDetail

Functions ¶

func IsEqualFlowContext ¶

func IsEqualFlowContext(a Flow, b Flow) bool

IsEqualFlowContext check if the flow and another flow have equal values for all fields used in `AggregationHash`. This method is used for hash collision detection.

func Max ¶

func Max[T cmp.Ordered](a T, b T) T

Max returns the larger of two items, for any ordered type.

func Min ¶

func Min[T cmp.Ordered](a T, b T) T

Min returns the smaller of two items, for any ordered type.

Types ¶

type AdditionalFields ¶

type AdditionalFields = map[string]any

AdditionalFields holds additional fields collected

type EndianType ¶

type EndianType string

EndianType is used to configure additional fields endianness

var (
	// BigEndian is used to configure a big endian additional field
	BigEndian EndianType = "big"
	// LittleEndian is used to configure a little endian additional field
	LittleEndian EndianType = "little"
)

type FieldType ¶

type FieldType string

FieldType is used to configure additional fields data type

var (
	// String type is used to configure a textual additional field
	String FieldType = "string"
	// Integer type is used to configure an integer additional field
	Integer FieldType = "integer"
	// Hex type is used to configure a hex additional field
	Hex FieldType = "hex"
	// DefaultFieldTypes contains types for default payload fields
	DefaultFieldTypes = map[string]FieldType{
		"direction":         Integer,
		"start":             Integer,
		"end":               Integer,
		"bytes":             Integer,
		"packets":           Integer,
		"ether_type":        Integer,
		"ip_protocol":       Integer,
		"exporter.ip":       Hex,
		"source.ip":         Hex,
		"source.port":       Integer,
		"source.mac":        Integer,
		"source.mask":       Integer,
		"destination.ip":    Hex,
		"destination.port":  Integer,
		"destination.mac":   Integer,
		"destination.mask":  Integer,
		"ingress.interface": Integer,
		"egress.interface":  Integer,
		"tcp_flags":         Integer,
		"next_hop.ip":       Hex,
		"tos":               Integer,
	}
)

type Flow ¶

type Flow struct {
	Namespace    string
	FlowType     FlowType
	SequenceNum  uint32
	SamplingRate uint64
	Direction    uint32

	// Exporter information
	ExporterAddr []byte

	// Flow time
	StartTimestamp uint64 // in seconds
	EndTimestamp   uint64 // in seconds

	// Size of the sampled packet
	Bytes   uint64
	Packets uint64

	// Source/destination addresses
	SrcAddr []byte // FLOW KEY
	DstAddr []byte // FLOW KEY

	// Layer 3 protocol (IPv4/IPv6/ARP/MPLS...)
	EtherType uint32

	// Layer 4 protocol
	IPProtocol uint32 // FLOW KEY

	// Flags
	TCPFlags uint32 `json:"tcp_flags"`

	// Ports for UDP and TCP
	// Port number can be zero/positive or `-1` (ephemeral port)
	SrcPort int32 // FLOW KEY
	DstPort int32 // FLOW KEY

	// SNMP Interface Index
	InputInterface  uint32 // FLOW KEY
	OutputInterface uint32

	// Mac Address
	SrcMac uint64
	DstMac uint64

	// Mask
	SrcMask uint32
	DstMask uint32

	// Reverse DNS enrichment added during Flow aggregation processing
	SrcReverseDNSHostname string
	DstReverseDNSHostname string

	// Ethernet information
	Tos uint32 // FLOW KEY

	NextHop []byte // FLOW KEY

	// Configured fields
	AdditionalFields AdditionalFields
}

Flow contains flow info used for aggregation json annotations are used in AsJSONString() for debugging purpose

func (*Flow) AggregationHash ¶

func (f *Flow) AggregationHash() uint64

AggregationHash return a hash used as aggregation key

type FlowMessageWithAdditionalFields ¶

type FlowMessageWithAdditionalFields struct {
	*flowmessage.FlowMessage
	AdditionalFields AdditionalFields
}

FlowMessageWithAdditionalFields contains a goflow flowmessage and additional fields

type FlowType ¶

type FlowType string

FlowType represent the flow protocol (netflow5,netflow9,ipfix, sflow, etc)

const (
	TypeIPFIX    FlowType = "ipfix"
	TypeSFlow5   FlowType = "sflow5"
	TypeNetFlow5 FlowType = "netflow5"
	TypeNetFlow9 FlowType = "netflow9"
	TypeUnknown  FlowType = "unknown"
)

Flow Types

func GetAllFlowTypes ¶

func GetAllFlowTypes() []FlowType

GetAllFlowTypes returns all flow names

type FlowTypeDetail ¶

type FlowTypeDetail struct {
	// contains filtered or unexported fields
}

FlowTypeDetail represent the flow protocol (netflow5,netflow9,ipfix, sflow, etc)

func GetFlowTypeByName ¶

func GetFlowTypeByName(name FlowType) (FlowTypeDetail, error)

GetFlowTypeByName search FlowTypeDetail by name

func (FlowTypeDetail) DefaultPort ¶

func (f FlowTypeDetail) DefaultPort() uint16

DefaultPort returns the default port

func (FlowTypeDetail) Name ¶

func (f FlowTypeDetail) Name() FlowType

Name returns the flow type name

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL