types

Documentation

Overview

Package types contains the basic types used by the library.

Index

• Constants
• func BenchmarkModule(dumpsDir string, module Module, times int) error
• func DestroyCache()
• func FlushTrackedFlows()
• func InitCache(expirationTime time.Duration)
• type ClassificationResult
  • func (result ClassificationResult) String() string
• type ClassificationSource
• type Flow
  • func CreateFlowFromPacket(packet gopacket.Packet) (flow *Flow)
  • func GetFlowForPacket(packet gopacket.Packet) (flow *Flow, isNew bool)
  • func NewFlow() (flow *Flow)
  • func (flow *Flow) AddPacket(packet gopacket.Packet)
  • func (flow *Flow) GetClassificationResult() (result ClassificationResult)
  • func (flow *Flow) GetPackets() (packets []gopacket.Packet)
  • func (flow *Flow) SetClassificationResult(protocol Protocol, source ClassificationSource)
• type MockModule
  • func (module *MockModule) ClassifyFlow(flow *Flow) (result ClassificationResult)
  • func (module *MockModule) ClassifyFlowAll(flow *Flow) (results []ClassificationResult)
  • func (module *MockModule) Destroy() error
  • func (module *MockModule) Initialize() error
• type Module
• type Protocol

Constants

const NoSource = ""

NoSource is returned if no classification was made.

Functions

func BenchmarkModule

func BenchmarkModule(dumpsDir string, module Module, times int) error

BenchmarkModule runs a module on all available dump files. It is used for benchmarking the modules.

func DestroyCache

func DestroyCache()

DestroyCache frees the resources used by the flow cache.

func FlushTrackedFlows

func FlushTrackedFlows()

FlushTrackedFlows flushes the map used for tracking flows. Any new packets that arrive after this operation will be considered new flows.

func InitCache

func InitCache(expirationTime time.Duration)

InitCache initializes the flow cache. It must be called before the cache is utilised. Flows will be discarded if they are inactive for the given duration. If that value is negative, flows will never expire.

Types

type ClassificationResult

type ClassificationResult struct {
	Protocol Protocol
	Source   ClassificationSource
}

ClassificationResult contains the detected protocol and the source of the classification from a classification attempt.

func (ClassificationResult) String

func (result ClassificationResult) String() string

type ClassificationSource

type ClassificationSource string

ClassificationSource is the module of the library that is responsible for the classification of a flow.

type Flow

type Flow struct {
	// contains filtered or unexported fields
}

Flow contains sufficient information to classify a flow.

func CreateFlowFromPacket

func CreateFlowFromPacket(packet gopacket.Packet) (flow *Flow)

CreateFlowFromPacket creates a flow with a single packet.

func GetFlowForPacket

func GetFlowForPacket(packet gopacket.Packet) (flow *Flow, isNew bool)

GetFlowForPacket finds any previous flow that the packet belongs to. It adds the packet to that flow and returns the flow. If no such flow is found, a new one is created.

func NewFlow

func NewFlow() (flow *Flow)

NewFlow creates an empty flow.

func (*Flow) AddPacket

func (flow *Flow) AddPacket(packet gopacket.Packet)

AddPacket adds a new packet to the flow.

func (*Flow) GetClassificationResult

func (flow *Flow) GetClassificationResult() (result ClassificationResult)

GetClassificationResult returns the currently detected protocol for this flow and the source of that detection.

func (*Flow) GetPackets

func (flow *Flow) GetPackets() (packets []gopacket.Packet)

GetPackets returns the list of packets in a thread-safe way.

func (*Flow) SetClassificationResult

func (flow *Flow) SetClassificationResult(protocol Protocol, source ClassificationSource)

SetClassificationResult sets the detected protocol and classification source for this flow.

type MockModule

type MockModule struct {
	InitSuccess     bool
	InitCalled      int
	DestroySuccess  bool
	DestroyCalled   int
	ClassifySuccess bool
	ClassifyCalled  int
	SourceName      string
}

MockModule is used in tests in order to test the functionality of modules.

func (*MockModule) ClassifyFlow

func (module *MockModule) ClassifyFlow(flow *Flow) (result ClassificationResult)

ClassifyFlow logs the classification by the mock module.

func (*MockModule) ClassifyFlowAll

func (module *MockModule) ClassifyFlowAll(flow *Flow) (results []ClassificationResult)

ClassifyFlowAll logs the multiple classification by the mock module.

func (*MockModule) Destroy

func (module *MockModule) Destroy() error

Destroy logs the destruction of the mock module.

func (*MockModule) Initialize

func (module *MockModule) Initialize() error

Initialize logs the initialization of the mock module.

type Module

type Module interface {
	Initialize() error
	Destroy() error
	ClassifyFlow(*Flow) ClassificationResult
	ClassifyFlowAll(*Flow) []ClassificationResult
}

Module is implemented by every classification module provided by the library. Each module has its own initialization and destruction methods, as well as their own method for classifying a flow. They may also be enabled or disabled and usually will also provide a configuration method.

type Protocol

type Protocol string

Protocol is the type of each of the detected protocols.

const (
	HTTP       Protocol = "HTTP"
	DNS        Protocol = "DNS"
	SSH        Protocol = "SSH"
	RPC        Protocol = "RPC"
	SMTP       Protocol = "SMTP"
	RDP        Protocol = "RDP"
	SMB        Protocol = "SMB"
	ICMP       Protocol = "ICMP"
	FTP        Protocol = "FTP"
	SSL        Protocol = "SSL"
	NetBIOS    Protocol = "NetBIOS"
	JABBER     Protocol = "JABBER"
	MQTT       Protocol = "MQTT"
	BITTORRENT Protocol = "BitTorrent"
	Unknown    Protocol = ""
)

Protocol identifiers for the supported protocols