Struct ConnHistory

pub struct ConnHistory {
    pub history: Vec<u8>,
}

Connection history.

This represents a summary of the connection history in the order the packets were observed, with letters encoded as a vector of bytes. This is a simplified version of state history in Zeek, and the meanings of each letter are similar: If the event comes from the originator, the letter is uppercase; if the event comes from the responder, the letter is lowercase.

• S: a pure SYN with only the SYN bit set (may have payload)
• H: a pure SYNACK with only the SYN and ACK bits set (may have payload)
• A: a pure ACK with only the ACK bit set and no payload
• D: segment contains non-zero payload length
• F: the segment has the FIN bit set (may have other flags and/or payload)
• R: segment has the RST bit set (may have other flags and/or payload)

Each letter is recorded a maximum of once in either direction.

Fields

history: Vec<u8>

Trait Implementations

impl Clone for ConnHistory

fn clone(&self) -> ConnHistory

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConnHistory

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ConnHistory

fn default() -> ConnHistory

Returns the “default value” for a type.

impl Serialize for ConnHistory

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Tracked for ConnHistory

fn new(_first_pkt: &L4Pdu) -> Self

Initialize internal data; called once per connection. Note first_pkt will also be delivered to update.

fn clear(&mut self)

Clear internal data; called if connection no longer matches filter that requires the Tracked type.

fn update(&mut self, pdu: &L4Pdu, reassembled: bool)

New packet in connection received (or reassembled, if reassembled=true) Note this may be invoked both pre- and post-reassembly; types should check reassembled to avoid double-counting.

fn stream_protocols() -> Vec<&'static str>

The stream protocols (lower-case) required for this datatype. See IMPLEMENTED_PROTOCOLS in retina_core for list of supported protocols.