decode

Documentation

Index

• func DNSRcodeToStr(rcode uint32) string
• func PBFlowToMap(pb *pbflow.Record) config.GenericMap
• func PktDropCauseToStr(dropCause uint32) string
• func RecordToMap(fr *flow.Record) config.GenericMap
• func TCPStateToStr(state uint32) string
• type Protobuf
  • func NewProtobuf() (*Protobuf, error)
  • func (p *Protobuf) Decode(rawFlow []byte) (config.GenericMap, error)

Functions

func DNSRcodeToStr

func DNSRcodeToStr(rcode uint32) string

DNSRcodeToStr decode DNS flags response code bits and return a string https://datatracker.ietf.org/doc/html/rfc2929#section-2.3

func PBFlowToMap

func PBFlowToMap(pb *pbflow.Record) config.GenericMap

func PktDropCauseToStr

func PktDropCauseToStr(dropCause uint32) string

PktDropCauseToStr is based on kernel drop cause definition https://elixir.bootlin.com/linux/latest/source/include/net/dropreason.h#L88 nolint:cyclop

func RecordToMap

func RecordToMap(fr *flow.Record) config.GenericMap

RecordToMap converts the flow from Agent inner model into FLP GenericMap model

func TCPStateToStr

func TCPStateToStr(state uint32) string

TCPStateToStr is based on kernel TCP state definition https://elixir.bootlin.com/linux/v6.3/source/include/net/tcp_states.h#L12

Types

type Protobuf

type Protobuf struct {
}

Protobuf decodes protobuf flow records definitions, as forwarded by ingest.NetObservAgent, into a Generic Map that follows the same naming conventions as the IPFIX flows from ingest.IngestCollector

func NewProtobuf

func NewProtobuf() (*Protobuf, error)

func (*Protobuf) Decode

func (p *Protobuf) Decode(rawFlow []byte) (config.GenericMap, error)

Decode decodes the protobuf raw flows and returns a list of GenericMaps representing all the flows there