engine

type Config struct {
	Registry *parser.Registry
	Sink     event.Sink
	Logger   *slog.Logger

	// StreamTimeout is how long a TCP connection may sit idle before it is
	// flushed and closed. Too low truncates slow connections; too high holds
	// memory for connections that ended without a FIN.
	StreamTimeout time.Duration
	// FlushInterval is how often, in capture time, idle connections are swept.
	FlushInterval time.Duration
}

type Engine struct {
	// contains filtered or unexported fields
}

type Stats struct {
	Packets      uint64 `json:"packets"`
	Bytes        uint64 `json:"bytes"`
	Events       uint64 `json:"events"`
	Streams      uint64 `json:"streams"`
	Unhandled    uint64 `json:"unhandled"`
	DecodeErrors uint64 `json:"decode_errors"`
	ParseErrors  uint64 `json:"parse_errors"`
	StreamGaps   uint64 `json:"stream_gaps"`
	// Tunnelled counts packets that arrived inside an encapsulation.
	Tunnelled uint64 `json:"tunnelled,omitzero"`

	// Capture holds libpcap's own counters, and is absent for a capture file.
	// Its Dropped field is the one that matters: a live capture that cannot
	// keep up silently reports less than it saw, and every other number here
	// is an undercount when it is nonzero.
	Capture *capture.Stats `json:"capture,omitempty"`
}