logging

Documentation

Index

• func NewPcapLogger(logDir, archiveDir string, flow *types.TcpIpFlow, pcapLogNum int, ...) types.PacketLogger
• type AttackJsonLogger
  • func NewAttackJsonLogger(archiveDir string) *AttackJsonLogger
  • func (a *AttackJsonLogger) Log(event *types.Event)
  • func (a *AttackJsonLogger) Publish(event *SerializedEvent)
  • func (a *AttackJsonLogger) SerializeAndWrite(event *types.Event)
  • func (a *AttackJsonLogger) Start()
  • func (a *AttackJsonLogger) Stop()
• type AttackMetadataJsonLogger
  • func NewAttackMetadataJsonLogger(archiveDir string) *AttackMetadataJsonLogger
  • func (a *AttackMetadataJsonLogger) Log(event *types.Event)
  • func (a *AttackMetadataJsonLogger) Publish(event *SerializedEvent)
  • func (a *AttackMetadataJsonLogger) SerializeAndWrite(event *types.Event)
  • func (a *AttackMetadataJsonLogger) Start()
  • func (a *AttackMetadataJsonLogger) Stop()
• type PcapLogger
  • func (p *PcapLogger) Archive()
  • func (p *PcapLogger) Remove()
  • func (p *PcapLogger) Start()
  • func (p *PcapLogger) Stop()
  • func (p *PcapLogger) WriteHeader()
  • func (p *PcapLogger) WritePacket(rawPacket []byte, timestamp time.Time)
  • func (p *PcapLogger) WritePacketToFile(rawPacket []byte, timestamp time.Time)
• type PcapLoggerFactory
  • func NewPcapLoggerFactory(logDir, archiveDir string, pcapLogNum, pcapQuota int) PcapLoggerFactory
  • func (f PcapLoggerFactory) Build(flow *types.TcpIpFlow) types.PacketLogger
• type RotatingQuotaWriter
  • func NewRotatingQuotaWriter(filename string, quotaSize int, numLogs int, headerFunc func()) *RotatingQuotaWriter
  • func (w *RotatingQuotaWriter) Close() error
  • func (w *RotatingQuotaWriter) Write(output []byte) (int, error)
• type SerializedEvent
• type TimedPacket

Functions

func NewPcapLogger

func NewPcapLogger(logDir, archiveDir string, flow *types.TcpIpFlow, pcapLogNum int, pcapQuota int) types.PacketLogger

Types

type AttackJsonLogger

type AttackJsonLogger struct {
	ArchiveDir string
	// contains filtered or unexported fields
}

AttackJsonLogger is responsible for recording all attack reports as JSON objects in a file.

func NewAttackJsonLogger

func NewAttackJsonLogger(archiveDir string) *AttackJsonLogger

NewAttackJsonLogger returns a pointer to a AttackJsonLogger struct

func (*AttackJsonLogger) Log

func (a *AttackJsonLogger) Log(event *types.Event)

func (*AttackJsonLogger) Publish

func (a *AttackJsonLogger) Publish(event *SerializedEvent)

Publish writes a JSON report to the attack-report file for that flow.

func (*AttackJsonLogger) SerializeAndWrite

func (a *AttackJsonLogger) SerializeAndWrite(event *types.Event)

func (*AttackJsonLogger) Start

func (a *AttackJsonLogger) Start()

func (*AttackJsonLogger) Stop

func (a *AttackJsonLogger) Stop()

type AttackMetadataJsonLogger

type AttackMetadataJsonLogger struct {
	ArchiveDir string
	// contains filtered or unexported fields
}

AttackMetadataJsonLogger is responsible for recording all attack reports as JSON objects in a file. This attack logger only logs metadata... but ouch code duplication.

func NewAttackMetadataJsonLogger

func NewAttackMetadataJsonLogger(archiveDir string) *AttackMetadataJsonLogger

NewAttackMetadataJsonLogger returns a pointer to a AttackMetadataJsonLogger struct

func (*AttackMetadataJsonLogger) Log

func (a *AttackMetadataJsonLogger) Log(event *types.Event)

func (*AttackMetadataJsonLogger) Publish

func (a *AttackMetadataJsonLogger) Publish(event *SerializedEvent)

Publish writes a JSON report to the attack-report file for that flow.

func (*AttackMetadataJsonLogger) SerializeAndWrite

func (a *AttackMetadataJsonLogger) SerializeAndWrite(event *types.Event)

func (*AttackMetadataJsonLogger) Start

func (a *AttackMetadataJsonLogger) Start()

func (*AttackMetadataJsonLogger) Stop

func (a *AttackMetadataJsonLogger) Stop()

type PcapLogger

type PcapLogger struct {
	LogDir     string
	ArchiveDir string
	Flow       *types.TcpIpFlow
	// contains filtered or unexported fields
}

PcapLogger struct is used to log packets to a pcap file

func (*PcapLogger) Archive

func (p *PcapLogger) Archive()

func (*PcapLogger) Remove

func (p *PcapLogger) Remove()

func (*PcapLogger) Start

func (p *PcapLogger) Start()

func (*PcapLogger) Stop

func (p *PcapLogger) Stop()

func (*PcapLogger) WriteHeader

func (p *PcapLogger) WriteHeader()

func (*PcapLogger) WritePacket

func (p *PcapLogger) WritePacket(rawPacket []byte, timestamp time.Time)

func (*PcapLogger) WritePacketToFile

func (p *PcapLogger) WritePacketToFile(rawPacket []byte, timestamp time.Time)

type PcapLoggerFactory

type PcapLoggerFactory struct {
	LogDir     string
	ArchiveDir string
	PcapLogNum int
	PcapQuota  int
}

func NewPcapLoggerFactory

func NewPcapLoggerFactory(logDir, archiveDir string, pcapLogNum, pcapQuota int) PcapLoggerFactory

func (PcapLoggerFactory) Build

func (f PcapLoggerFactory) Build(flow *types.TcpIpFlow) types.PacketLogger

type RotatingQuotaWriter

type RotatingQuotaWriter struct {
	// contains filtered or unexported fields
}

func NewRotatingQuotaWriter

func NewRotatingQuotaWriter(filename string, quotaSize int, numLogs int, headerFunc func()) *RotatingQuotaWriter

NewRotatingQuotaWriter takes a "starting filename" and a quota size in bytes... and guarantees to behave as an io.Writer who will write no more than quotaSize bytes to disk. `headerFunc` is executed upon the new file, after each rotation.

func (*RotatingQuotaWriter) Close

func (w *RotatingQuotaWriter) Close() error

func (*RotatingQuotaWriter) Write

func (w *RotatingQuotaWriter) Write(output []byte) (int, error)

type SerializedEvent

type SerializedEvent struct {
	Type                     string
	Time                     time.Time
	PacketCount              uint64
	Flow                     string
	HijackSeq                uint32
	HijackAck                uint32
	Payload                  string
	Overlap                  string
	Start, End               types.Sequence
	OverlapStart, OverlapEnd int
}

type TimedPacket

type TimedPacket struct {
	RawPacket []byte
	Timestamp time.Time
}