flow

Documentation

Index

• type Flow
  • func FlowFromLayers(networkLayer gopacket.NetworkLayer, transportLayer gopacket.TransportLayer) (Flow, error)
  • func (f *Flow) GuessType()
• type FlowKey
  • func GetPacketFlowKey(networkLayer gopacket.NetworkLayer, transportLayer gopacket.TransportLayer) (FlowKey, error)
  • func (fk *FlowKey) Hash() uint64
  • func (fk *FlowKey) Reverse() FlowKey
  • func (fk *FlowKey) String() string
• type FlowMetadata
• type FlowType

Types

type Flow

type Flow struct {
	NetworkType          gopacket.LayerType
	TransportType        gopacket.LayerType
	NetworkSourceAddress net.IP
	NetworkDestAddress   net.IP
	TransportSourcePort  uint16
	TransportDestPort    uint16
	Protocol             layers.IPProtocol
	Type                 FlowType
	FlowMetadata
}

Flow represents an aggregated network flow of TCP traffic

func FlowFromLayers

func FlowFromLayers(networkLayer gopacket.NetworkLayer, transportLayer gopacket.TransportLayer) (Flow, error)

func (*Flow) GuessType

func (f *Flow) GuessType()

type FlowKey

type FlowKey struct {
	NetworkSourceEndpoint   gopacket.Endpoint
	NetworkDestEndpoint     gopacket.Endpoint
	TransportSourceEndpoint gopacket.Endpoint
	TransportDestEndpoint   gopacket.Endpoint
	Protocol                layers.IPProtocol
}

FlowKey represents the unique 5-tuple flow key used for tracking a flow The key must be "comparable" so it can be used as a map key

func GetPacketFlowKey

func GetPacketFlowKey(networkLayer gopacket.NetworkLayer, transportLayer gopacket.TransportLayer) (FlowKey, error)

GetPacketFlowKey returns the unique flow key of a packet

func (*FlowKey) Hash

func (fk *FlowKey) Hash() uint64

Hash returns a 32bit hash of the flow key

func (*FlowKey) Reverse

func (fk *FlowKey) Reverse() FlowKey

func (*FlowKey) String

func (fk *FlowKey) String() string

type FlowMetadata

type FlowMetadata struct {
	FlowStartMilliseconds uint64
	FlowEndMilliseconds   uint64
	TotalBytes            uint64
	TotalPackets          uint64
	ReverseTotalBytes     uint64
	ReverseTotalPackets   uint64
}

type FlowType

type FlowType int

const (
	Initiator FlowType = iota
	Responder
	Unknown
)