flow

Documentation

Index

• Constants
• type Accounter
  • func NewAccounter(maxEntries, evictBufferLen int, evictTimeout time.Duration) *Accounter
  • func (c *Accounter) Account(in <-chan *Record, out chan<- []*Record)
• type DataLink
• type Direction
• type HumanBytes
• type IPAddr
  • func (ia *IPAddr) IP() net.IP
  • func (ia *IPAddr) IntEncodeV4() uint32
  • func (ia *IPAddr) MarshalJSON() ([]byte, error)
• type MacAddr
  • func (m *MacAddr) MarshalJSON() ([]byte, error)
  • func (m *MacAddr) String() string
• type Network
• type Record
  • func ReadFrom(reader io.Reader) (*Record, error)
  • func (r *Record) Accumulate(src *Record)
• type Transport

Constants

const IPv6Type = 0x86DD

IPv6Type value as defined in IEEE 802: https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml

const MacLen = 6

Types

type Accounter

type Accounter struct {
	// contains filtered or unexported fields
}

Accounter accumulates flows metrics in memory and eventually evicts them via an evictor channel. It is not safe for concurrent access so if at some point you need to parallelize also the accounting process you should either: (1) reimplement the Accounter by using a concurrent map implementation and performing the properties operations atomically; or (2) spinup parallel accounters that evict the flow records to another accounter that consolidates data from all (some kind of map-reduce).

func NewAccounter

func NewAccounter(maxEntries, evictBufferLen int, evictTimeout time.Duration) *Accounter

NewAccounter creates a new Accounter. The cache has no limit and it's assumed that eviction is done by the caller.

func (*Accounter) Account

func (c *Accounter) Account(in <-chan *Record, out chan<- []*Record)

Account runs in a new goroutine. It reads all the records from the input channel and accumulate their metrics internally. Once the metrics have reached their max size or the eviction times out, it evicts all the accumulated flows by the returned channel.

type DataLink

type DataLink struct {
	SrcMac MacAddr
	DstMac MacAddr
}

type Direction

type Direction uint8

type HumanBytes

type HumanBytes uint64

type IPAddr

type IPAddr [net.IPv6len]uint8

IPAddr encodes v4 and v6 IPs with a fixed length. IPv4 addresses are encoded as IPv6 addresses with prefix ::ffff/96 as described in https://datatracker.ietf.org/doc/html/rfc4038#section-4.2 (same behavior as Go's net.IP type)

func (*IPAddr) IP

func (ia *IPAddr) IP() net.IP

IP returns the net.IP equivalent object

func (*IPAddr) IntEncodeV4

func (ia *IPAddr) IntEncodeV4() uint32

IntEncodeV4 encodes an IPv4 address as an integer (in network encoding, big endian). It assumes that the passed IP is already IPv4. Otherwise it would just encode the last 4 bytes of an IPv6 address

func (*IPAddr) MarshalJSON

func (ia *IPAddr) MarshalJSON() ([]byte, error)

type MacAddr

type MacAddr [MacLen]uint8

func (*MacAddr) MarshalJSON

func (m *MacAddr) MarshalJSON() ([]byte, error)

func (*MacAddr) String

func (m *MacAddr) String() string

type Network

type Network struct {
	SrcAddr IPAddr
	DstAddr IPAddr
}

type Record

type Record struct {
	TimeFlowStart time.Time
	TimeFlowEnd   time.Time
	Interface     string
	Packets       int
	// contains filtered or unexported fields
}

Record contains accumulated metrics from a flow

func ReadFrom

func ReadFrom(reader io.Reader) (*Record, error)

ReadFrom reads a Record from a binary source, in LittleEndian order

func (*Record) Accumulate

func (r *Record) Accumulate(src *Record)

type Transport

type Transport struct {
	SrcPort  uint16
	DstPort  uint16
	Protocol uint8 `json:"Proto"`
}