portrollup

Documentation

Overview

Package portrollup provides a type for tracking observed connections between ports on different devices and identifying when a port connects to many different ports and so should have all traffic rolled up into a single flow for reporting purposes.

Index

• Constants
• type EndpointPairPortRollupStore
  • func NewEndpointPairPortRollupStore(portRollupThreshold int) *EndpointPairPortRollupStore
  • func (prs *EndpointPairPortRollupStore) Add(sourceAddr []byte, destAddr []byte, sourcePort uint16, destPort uint16)
  • func (prs *EndpointPairPortRollupStore) AddToStore(store map[string][]uint16, srcToDestKey string, destToSrcKey string, ...)
  • func (prs *EndpointPairPortRollupStore) GetCurrentStoreSize() int
  • func (prs *EndpointPairPortRollupStore) GetDestToSourcePortCount(sourceAddr []byte, destAddr []byte, destPort uint16) uint16
  • func (prs *EndpointPairPortRollupStore) GetNewStoreSize() int
  • func (prs *EndpointPairPortRollupStore) GetPortCount(sourceAddr []byte, destAddr []byte, sourcePort uint16, destPort uint16) (uint16, bool)
  • func (prs *EndpointPairPortRollupStore) GetSourceToDestPortCount(sourceAddr []byte, destAddr []byte, sourcePort uint16) uint16
  • func (prs *EndpointPairPortRollupStore) IsEphemeral(sourceAddr []byte, destAddr []byte, sourcePort uint16, destPort uint16) IsEphemeralStatus
  • func (prs *EndpointPairPortRollupStore) IsEphemeralFromKeys(srcToDestKey string, destToSrcKey string) IsEphemeralStatus
  • func (prs *EndpointPairPortRollupStore) UseNewStoreAsCurrentStore()
• type IsEphemeralStatus

Constants

const (
	// NoEphemeralPort both source port and destination are not ephemeral
	NoEphemeralPort = IsEphemeralStatus(0)
	// IsEphemeralSourcePort represent whether source port is ephemeral
	IsEphemeralSourcePort = IsEphemeralStatus(1)
	// IsEphemeralDestPort represent whether destination port is ephemeral
	IsEphemeralDestPort = IsEphemeralStatus(2)
)

const EphemeralPort int32 = -1

EphemeralPort port number is represented by `-1` internally

Types

type EndpointPairPortRollupStore

type EndpointPairPortRollupStore struct {
	// contains filtered or unexported fields
}

EndpointPairPortRollupStore contains port rollup states. It tracks ports that have been seen so far and help decide whether a port should be rolled up or not. We use two stores (curStore, newStore) to be able to clean old tracked ports when they are not seen anymore. Adding a port will double write to curStore and newStore. This means a port is tracked for `2 * portRollupThreshold` seconds. When IsEphemeral is called, only curStore is used. UseNewStoreAsCurrentStore is meant to be called externally to use new store as current store and empty the new store.

func NewEndpointPairPortRollupStore

func NewEndpointPairPortRollupStore(portRollupThreshold int) *EndpointPairPortRollupStore

NewEndpointPairPortRollupStore create a new *EndpointPairPortRollupStore

func (*EndpointPairPortRollupStore) Add

func (prs *EndpointPairPortRollupStore) Add(sourceAddr []byte, destAddr []byte, sourcePort uint16, destPort uint16)

Add will record new sourcePort and destPort for a specific sourceAddr and destAddr

func (*EndpointPairPortRollupStore) AddToStore

func (prs *EndpointPairPortRollupStore) AddToStore(store map[string][]uint16, srcToDestKey string, destToSrcKey string, sourceAddr []byte, destAddr []byte, sourcePort uint16, destPort uint16, curStoreIsEphemeralStatus IsEphemeralStatus)

AddToStore will add ports to store

func (*EndpointPairPortRollupStore) GetCurrentStoreSize

func (prs *EndpointPairPortRollupStore) GetCurrentStoreSize() int

GetCurrentStoreSize get number of tracked port counters in current store

func (*EndpointPairPortRollupStore) GetDestToSourcePortCount

func (prs *EndpointPairPortRollupStore) GetDestToSourcePortCount(sourceAddr []byte, destAddr []byte, destPort uint16) uint16

GetDestToSourcePortCount returns the number of different source port for a specific destination port

func (*EndpointPairPortRollupStore) GetNewStoreSize

func (prs *EndpointPairPortRollupStore) GetNewStoreSize() int

GetNewStoreSize get number of tracked port counters in new store

func (*EndpointPairPortRollupStore) GetPortCount

func (prs *EndpointPairPortRollupStore) GetPortCount(sourceAddr []byte, destAddr []byte, sourcePort uint16, destPort uint16) (uint16, bool)

GetPortCount returns max port count and indicate whether the source or destination is ephemeral (isEphemeralSource)

func (*EndpointPairPortRollupStore) GetSourceToDestPortCount

func (prs *EndpointPairPortRollupStore) GetSourceToDestPortCount(sourceAddr []byte, destAddr []byte, sourcePort uint16) uint16

GetSourceToDestPortCount returns the number of different destination port for a specific source port

func (*EndpointPairPortRollupStore) IsEphemeral

func (prs *EndpointPairPortRollupStore) IsEphemeral(sourceAddr []byte, destAddr []byte, sourcePort uint16, destPort uint16) IsEphemeralStatus

IsEphemeral checks if source port and destination port are ephemeral

func (*EndpointPairPortRollupStore) IsEphemeralFromKeys

func (prs *EndpointPairPortRollupStore) IsEphemeralFromKeys(srcToDestKey string, destToSrcKey string) IsEphemeralStatus

IsEphemeralFromKeys gets the ephemeral status of a link based on its keys.

func (*EndpointPairPortRollupStore) UseNewStoreAsCurrentStore

func (prs *EndpointPairPortRollupStore) UseNewStoreAsCurrentStore()

UseNewStoreAsCurrentStore sets newStore to curStore and clean up newStore

type IsEphemeralStatus

type IsEphemeralStatus int32

IsEphemeralStatus enum type