decode

Documentation

Overview

Package decode provides multithreaded TCP packet decoding.

Index

• type DecodedPacket
  • func (dp *DecodedPacket) IsTCP() bool
• type Handler
• type Pool
  • func NewPool(logger log.Logger, numWorkers int, src capture.PacketSource, handler Handler) *Pool
  • func (p *Pool) Run()
  • func (p *Pool) Stats() Stats
• type Stats

Types

type DecodedPacket

type DecodedPacket struct {
	Info gopacket.CaptureInfo

	TCP      layers.TCP
	Payload  gopacket.Payload
	FlowHash uint64
	NetFlow  gopacket.Flow
	// contains filtered or unexported fields
}

DecodedPacket holds the broken down structure of a decoded TCP packet.

func (*DecodedPacket) IsTCP

func (dp *DecodedPacket) IsTCP() bool

IsTCP returns true if dp was successfully decoded as a TCP packet.

type Handler

type Handler func(db []*DecodedPacket)

Handler is a user-provided function for processing a single packet.

type Pool

type Pool struct {
	// contains filtered or unexported fields
}

Pool is a set of workers for decoding network packets. It is bound to a single PacketSource. A Pool operates on a pull model, only requesting packet data when there is a worker ready to receive it.

func NewPool

func NewPool(logger log.Logger, numWorkers int, src capture.PacketSource, handler Handler) *Pool

NewPool creates a new Pool of workers. As packets are captured and decoded, handler is invoked. handler is invoked from multiple worker gorountines concurrently and thus must be threadsafe.

func (*Pool) Run

func (p *Pool) Run()

Run starts the Pool decoding packets from the configured PacketSource and sending the results to the PacketHandler.

Packets are dropped if they arrive more rapidly than the Pool can handle them.

func (*Pool) Stats

func (p *Pool) Stats() Stats

Stats returns runtime statistics for a Pool.

type Stats

type Stats struct {
	PacketsCaptured int
	PacketsDropped  int
}

Stats contains runtime performance statistics for a Pool.