flow

type Accounter ¶

type Accounter struct {
	// contains filtered or unexported fields
}

Accounter accumulates flows metrics in memory and eventually evicts them via an evictor channel. It is not safe for concurrent access so if at some point you need to parallelize also the accounting process you should either: (1) reimplement the Accounter by using a concurrent map implementation and performing the properties operations atomically; or (2) spinup parallel accounters that evict the flow records to another accounter that consolidates data from all (some kind of map-reduce).

func NewAccounter(maxEntries, evictBufferLen int, evictTimeout time.Duration) *Accounter

func (c *Accounter) Account(in <-chan *Record, out chan<- []*Record)

type DataLink ¶

type DataLink struct {
	SrcMac MacAddr
	DstMac MacAddr
}

type Direction ¶

type Direction uint8

func (d Direction) MarshalJSON() ([]byte, error)

type HumanBytes ¶

type HumanBytes uint64

func (b HumanBytes) String() string

type MacAddr ¶

type MacAddr [MacLen]uint8

func (m *MacAddr) MarshalJSON() ([]byte, error)

func (m *MacAddr) String() string

type Network ¶

type Network struct {
	SrcAddr RawIP
	DstAddr RawIP
}

type RawIP ¶

type RawIP uint32

TODO: support IPv6

func (i RawIP) MarshalJSON() ([]byte, error)

func (i RawIP) String() string

type Record ¶

type Record struct {
	TimeFlowStart time.Time
	TimeFlowEnd   time.Time
	Interface     string
	Packets       int
	// contains filtered or unexported fields
}

Record contains accumulated metrics from a flow

func ReadFrom(reader io.Reader) (*Record, error)

func (r *Record) Accumulate(src *Record)

type Transport ¶

type Transport struct {
	SrcPort  uint16
	DstPort  uint16
	Protocol TransportProtocol `json:"Proto"`
}

type TransportProtocol ¶

type TransportProtocol uint8

func (p TransportProtocol) MarshalJSON() ([]byte, error)

func (p TransportProtocol) String() string