flow

type BPF ¶ added in v0.10.0

type BPF struct {
	// contains filtered or unexported fields
}

func NewBPF(linkType layers.LinkType, captureLength uint32, filter string) (*BPF, error)

func (b *BPF) Matches(data []byte) bool

type ExpireUpdateFunc ¶ added in v0.3.0

type ExpireUpdateFunc func(f []*Flow)

type FlowEnhancer ¶ added in v0.10.0

type FlowEnhancer interface {
	Enhance(flow *Flow)
}

type FlowEnhancerPipeline ¶ added in v0.10.0

type FlowEnhancerPipeline struct {
	Enhancers []FlowEnhancer
}

func NewFlowEnhancerPipeline(enhancers ...FlowEnhancer) *FlowEnhancerPipeline

func (fe *FlowEnhancerPipeline) AddEnhancer(e FlowEnhancer)

func (fe *FlowEnhancerPipeline) Enhance(flows []*Flow)

func (fe *FlowEnhancerPipeline) EnhanceFlow(flow *Flow)

type FlowHandler ¶ added in v0.4.0

type FlowHandler struct {
	// contains filtered or unexported fields
}

func NewFlowHandler(callback ExpireUpdateFunc, every time.Duration) *FlowHandler

type FlowKey ¶

type FlowKey string

func FlowKeyFromGoPacket(p *gopacket.Packet, parentUUID string) FlowKey

func (f FlowKey) String() string

type FlowPacket ¶ added in v0.8.0

type FlowPacket struct {
	// contains filtered or unexported fields
}

type FlowPackets ¶ added in v0.8.0

type FlowPackets struct {
	Packets   []FlowPacket
	Timestamp int64
}

FlowPackets represents a suite of parent/child FlowPacket

func FlowPacketsFromGoPacket(packet *gopacket.Packet, outerLength int64, t int64, bpf *BPF) *FlowPackets

func FlowPacketsFromSFlowSample(sample *layers.SFlowFlowSample, t int64, bpf *BPF) []*FlowPackets

type GetAttr ¶ added in v0.5.0

type GetAttr interface {
	GetAttr(name string) interface{}
}

type InGRELayer ¶ added in v0.8.0

type InGRELayer struct {
	StrangeHeader []byte
	// contains filtered or unexported fields
}

func (m InGRELayer) LayerContents() []byte

func (m InGRELayer) LayerPayload() []byte

func (m InGRELayer) LayerType() gopacket.LayerType

type MergeContext ¶ added in v0.7.0

type MergeContext struct {
	Sort      bool
	SortBy    string
	SortOrder common.SortOrder
	Dedup     bool
	DedupBy   string
}

type PcapWriter ¶ added in v0.10.0

type PcapWriter struct {
	sync.WaitGroup
	// contains filtered or unexported fields
}

func NewPcapWriter(r io.ReadCloser, packetsChan chan *FlowPackets, replay bool, bpfFilter string) (*PcapWriter, error)

func (p *PcapWriter) FeedFlowTable()

func (p *PcapWriter) Start()

func (p *PcapWriter) Stop()

type Table ¶ added in v0.4.0

type Table struct {
	PacketsChan chan *FlowPackets
	// contains filtered or unexported fields
}

func NewTable(updateHandler *FlowHandler, expireHandler *FlowHandler, pipeline *FlowEnhancerPipeline) *Table

func (ft *Table) Query(query *TableQuery) *TableReply

func (ft *Table) Run()

func (ft *Table) SetNodeTID(tid string)

func (ft *Table) Start() chan *FlowPackets

func (ft *Table) Stop()

type TableAllocator ¶ added in v0.4.0

type TableAllocator struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

func NewTableAllocator(update, expire time.Duration, pipeline *FlowEnhancerPipeline) *TableAllocator

func (a *TableAllocator) Alloc(flowCallBack ExpireUpdateFunc) *Table

func (a *TableAllocator) QueryTable(query *TableQuery) *TableReply

func (a *TableAllocator) Release(t *Table)

type TableClient ¶ added in v0.4.0

type TableClient struct {
	shttp.DefaultWSServerEventHandler
	WSServer *shttp.WSServer
	// contains filtered or unexported fields
}

func NewTableClient(w *shttp.WSServer) *TableClient

func (f *TableClient) LookupFlows(flowSearchQuery filters.SearchQuery) (*FlowSet, error)

func (f *TableClient) LookupFlowsByNodes(hnmap topology.HostNodeTIDMap, flowSearchQuery filters.SearchQuery) (*FlowSet, error)

func (f *TableClient) OnMessage(c *shttp.WSClient, m shttp.WSMessage)

type TableQuery ¶ added in v0.4.0

type TableQuery struct {
	Type string
	Obj  []byte
}

TableQuery contains a type and a query obj as an array of bytes. The query can be encoded in different ways according the type.

type TableReply ¶ added in v0.4.0

type TableReply struct {
	Obj [][]byte
	// contains filtered or unexported fields
}

TableReply is the response to a TableQuery containing a Status and an array of replies that can be encoded in many ways, ex: json, protobuf.

type TableServer ¶ added in v0.4.0

type TableServer struct {
	shttp.DefaultWSClientEventHandler
	WSAsyncClientPool *shttp.WSAsyncClientPool
	TableAllocator    *TableAllocator
}

func NewServer(allocator *TableAllocator, wspool *shttp.WSAsyncClientPool) *TableServer

func (s *TableServer) OnMessage(c *shttp.WSAsyncClient, msg shttp.WSMessage)

func (s *TableServer) OnTableQuery(c *shttp.WSAsyncClient, msg shttp.WSMessage)