Struct Connection 

pub struct Connection {
    pub five_tuple: FiveTuple,
    pub ts: Instant,
    pub duration: Duration,
    pub max_inactivity: Duration,
    pub time_to_second_packet: Duration,
    pub history: Vec<u8>,
    pub orig: Flow,
    pub resp: Flow,
}

A connection record.

This subscribable type returns general information regarding TCP and UDP connections but does does not track payload data. If applicable, Retina internally manages stream reassembly. All connections are interpreted using flow semantics.

Fields

five_tuple: FiveTuple

The connection 5-tuple.

ts: Instant

Timestamp of the first packet.

Remarks

This represents the time Retina observed the first packet in the connection, and does not reflect timestamps read from a packet capture in offline analysis.

duration: Duration

The duration of the connection.

Remarks

This does not represent the actual duration of the connection in offline analysis. It approximates the elapsed time between observation of the first and last observed packet in the connection.

max_inactivity: Duration

Maximum duration of inactivity (the maximum time between observed segments).

time_to_second_packet: Duration

The duration between the first and second packets.

history: Vec<u8>

Connection history.

This represents a summary of the connection history in the order the packets were observed, with letters encoded as a vector of bytes. This is a simplified version of state history in Zeek, and the meanings of each letter are similar: If the event comes from the originator, the letter is uppercase; if the event comes from the responder, the letter is lowercase.

• S: a pure SYN with only the SYN bit set (may have payload)
• H: a pure SYNACK with only the SYN and ACK bits set (may have payload)
• A: a pure ACK with only the ACK bit set and no payload
• D: segment contains non-zero payload length
• F: the segment has the FIN bit set (may have other flags and/or payload)
• R: segment has the RST bit set (may have other flags and/or payload)

Each letter is recorded a maximum of once in either direction.

orig: Flow

Originator flow.

resp: Flow

Responder flow.

Implementations

impl Connection

pub fn client(&self) -> SocketAddr

Returns the client (originator) socket address.

pub fn server(&self) -> SocketAddr

Returns the server (responder) socket address.

pub fn total_pkts(&self) -> u64

Returns the total number of packets observed in the connection.

pub fn total_bytes(&self) -> u64

Returns the total number of payload bytes observed, excluding those from malformed packets.

pub fn history(&self) -> String

Returns the connection history.

Trait Implementations

impl Debug for Connection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Connection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for Connection

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl Subscribable for Connection

type Tracked = TrackedConnection

fn level() -> Level

Returns the subscription level.

fn parsers() -> Vec<ConnParser>

Returns a list of protocol parsers required to parse the subscribable type.

fn process_packet( mbuf: Mbuf, subscription: &Subscription<'_, Self>, conn_tracker: &mut ConnTracker<Self::Tracked>, )

Process a single incoming packet.