Struct Flow

pub struct Flow {
    pub nb_pkts: u64,
    pub nb_malformed_pkts: u64,
    pub nb_late_start_pkts: u64,
    pub nb_pkt_bytes: u64,
    pub nb_payload_bytes: u64,
    pub max_simult_gaps: u64,
    pub data_start: u32,
    pub capacity: usize,
    pub chunks: Vec<Chunk>,
    pub gaps: HashMap<u32, u64>,
}

A uni-directional flow.

Fields

nb_pkts: u64

Number of packets seen for this flow, including malformed and late start segments.

• Malformed segments are defined as those that have a payload offset (start of the payload, as computed from the header length field) beyond the end of the packet buffer, or the end of the payload exceeds the end of the packet buffer.
• Late start segments are those that arrive after the first packet seen in the flow, but have an earlier sequence number. Only applies to TCP flows.

nb_malformed_pkts: u64

Number of malformed packets.

nb_late_start_pkts: u64

Number of late start packets.

nb_pkt_bytes: u64

Number of packet bytes observed in the flow. Includes bytes from malformed segments and ethernet and ip headers.

nb_payload_bytes: u64

Number of payload bytes observed in the flow. Does not include bytes from malformed segments.

max_simult_gaps: u64

Maximum number of simultaneous content gaps.

A content gap is a “hole” in the TCP sequence number, indicated re-ordered or missing packets. Only applies to TCP flows.

data_start: u32

Starting sequence number of the first byte in the first payload (ISN + 1). Only applies to TCP flows, and is set to 0 for UDP.

capacity: usize

Maximum chunk capacity (the maximum number of simultaneous gaps + 1). Only applies to TCP flows. Used to prevent resizing chunks vector.

chunks: Vec<Chunk>

The set of non-overlapping content intervals. Only applies to TCP flows.

gaps: HashMap<u32, u64>

Maps relative sequence number of a content gap to the number of packets observed before it is filled. Only applies to TCP flows.

Implementations

impl Flow

pub fn content_gaps(&self) -> u64

Returns the number of content gaps at the connection end.

This is not the total number of content gaps ever observed, rather, it represents the total number of gaps remaining in the final state of the connection.

pub fn missed_bytes(&self) -> u64

Number of bytes missed in content gaps at connection end.

This is not the total size of all content gaps ever observed, rather, it represents the total number of missing bytes in the final state of the connection.

pub fn mean_pkts_to_fill(&self) -> Option<f64>

Returns the mean number of packet arrivals before a content gap is filled, or 0 if there were no gaps.

pub fn median_pkts_to_fill(&self) -> Option<u64>

Returns the median number of packet arrivals before a content gap is filled, or 0 if there were no gaps.

Trait Implementations

impl Clone for Flow

fn clone(&self) -> Flow

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Flow

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for Flow

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.