stream

var Debug bool

Debug controls debug log messages and behavior

var DefaultAbstractDecoders = []core.DecoderAPI{
	file.Decoder,
	service.Decoder,
	exploit.Decoder,
	mail.Decoder,
	software.Decoder,
	vulnerability.Decoder,
	credentials.Decoder,
	alert.Decoder,

} // contains all available abstract decoders

DefaultAbstractDecoders contains decoders for custom abstractions that do not represent a specific network protocol.

var DefaultStreamDecoders = map[int32]core.StreamDecoderAPI{
	21:    ftp.Decoder,
	22:    ssh.Decoder,
	25:    smtp.Decoder,
	80:    http.Decoder,
	102:   s7comm.Decoder,
	110:   pop3.Decoder,
	143:   imap.Decoder,
	179:   bgp.Decoder,
	443:   tls.Decoder,
	445:   smb.Decoder,
	502:   modbus.Decoder,
	514:   syslog.Decoder,
	1080:  socks.Decoder,
	1883:  mqttsn.Decoder,
	1884:  mqttsn.Decoder,
	2222:  cip.Decoder,
	3389:  rdp.Decoder,
	4840:  opcua.Decoder,
	6667:  irc.Decoder,
	8443:  tls.Decoder,
	20000: dnp3.Decoder,
	2404:  iec62351.Decoder,
	34964: profinet.Decoder,
	44818: cip.Decoder,
	47808: bacnetip.Decoder,

	49:    tacacs.Decoder,
	88:    kerberosaudit.Decoder,
	135:   dcerpc.Decoder,
	631:   ipp.Decoder,
	10050: zabbix.Decoder,
	10051: zabbix.Decoder,
	9090:  protobuf.Decoder,
	50051: protobuf.Decoder,

} // contains all available stream decoders

DefaultStreamDecoders contains stream decoders mapped to their protocols default port int32 is used to avoid casting when looking up values Note: Multiple decoders can share the same port if they use different transports (TCP vs UDP). The Transport() method is checked before CanDecode() to filter appropriately.

var SortedDecoderPorts []int32

SortedDecoderPorts provides a deterministic iteration order for DefaultStreamDecoders. Go maps have non-deterministic iteration order, which causes the fallback decoder scan (when no port-specific match is found) to select different decoders across runs. This sorted list ensures consistent decoder selection.

var UDPStreamDecoders = []core.StreamDecoderAPI{
	quic.Decoder,
	kerberosaudit.Decoder,
}

UDPStreamDecoders contains additional stream decoders specifically for UDP protocols. These are checked by the UDP stream processor when no match is found in DefaultStreamDecoders. This is particularly useful for protocols that share port numbers with TCP protocols (e.g., QUIC uses UDP port 443 while TLS uses TCP port 443).