service

package
v0.7.5 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 24, 2025 License: BSD-3-Clause, GPL-3.0 Imports: 25 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var Decoder = &decoder.AbstractDecoder{
	Type:        types.Type_NC_Service,
	Name:        "Service",
	Description: "A network service",
	PostInit: func(d *decoder.AbstractDecoder) error {
		var err error
		serviceLog, _, err = logging.InitZapLogger(
			decoderconfig.Instance.Out,
			"service",
			decoderconfig.Instance.Debug,
		)
		if err != nil {
			return err
		}

		serviceLogSugared = serviceLog.Sugar()

		return initServiceProbes()
	},
	DeInit: func(e *decoder.AbstractDecoder) error {
		// flush writer
		var err error
		for _, item := range Store.Items {
			item.Lock()

			if len(item.applications) > 0 {
				item.Service.Applications = make([]string, 0, len(item.applications))
				for app := range item.applications {
					item.Service.Applications = append(item.Service.Applications, app)
				}
			}

			err = e.Writer.Write(item.Service)
			if err != nil {
				serviceLog.Error("failed to flush service audit record", zap.Error(err))
			}
			item.Unlock()

			atomic.AddInt64(&e.NumRecordsWritten, 1)
		}

		return serviceLog.Sync()
	},
}

Decoder for protocol analysis and writing audit records to disk.

View Source
var Store = &atomicServiceMap{
	Items: make(map[string]*service),
}

Store ServiceStore holds all tcp service banners.

Functions

func AddApplications added in v0.7.5

func AddApplications(serviceIdent string, applications []string)

AddApplications adds DPI-detected application protocols to a service. This function is thread-safe and can be called from packet decoders.

func MatchServiceProbes

func MatchServiceProbes(serv *service, banner []byte, ident string)

MatchServiceProbes will check the service banner against the probes.

func NewService

func NewService(ts int64, numBytesServer, numBytesClient int, ip string) *service

NewService creates a new network service.

func ResetStore added in v0.7.5

func ResetStore()

ResetStore clears all services from memory This should be called when resetting state between processing different files

Types

This section is empty.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL