The Flow class represents both sides of a network connection. More...

#include "Flow.hpp"

Collaboration diagram for Myra::Flow:

Public Member Functions
	~Flow (void)
	Destructor. More...

	Flow (const FlowHash hash=0)
	Constructor. More...

	Flow (const Flow &rhs)
	Copy constructor for insertion into std::map. More...

Flow &	setup_traffic_exams (void)
	Setup all of the relevant traffic exams for the given flow. More...

Flow &	setup_port_based_traffic_exams (void)
	Last-ditch effort at identification uses simplistic port-based exams. More...

Flow &	add_packet (const uint8_t *raw, const std::size_t len, const L2::Ethertype type)
	Add another packet to this flow, and call the traffic exams. More...

std::string	to_string (void) const
	Use traffic_types to come up with a text string describing the flow. More...

Flow &	add_type (const Myra::Traffic::Type type)
	Add a type to traffic_types and set update_in_db if appropriate. More...

Flow &	del_type (const Myra::Traffic::Type type)
	Remove a type from traffic_types and set update_in_db if appropriate. More...

Flow &	replace_type (const Myra::Traffic::Type old_type, const Myra::Traffic::Type new_type)
	Remove a type (if it exists) from traffic_types and add a new type. More...

STAT	total_number_of_packets (void) const
	Get the total number of packets in this flow. More...

STAT	total_number_of_bytes (void) const
	Get the total number of bytes in this flow. More...


Flow &	replace_example_packet (const Myra::PktInfo &new_info)
	Replace example packet with this packet. Normally called once a flow has been classified. More...

Flow &	replace_example_packet (const uint8_t *raw, const std::size_t len, const L2::Ethertype type)

Public Attributes
Myra::DB::Id	db_id
	Database ID for this flow in the `flows` table. More...

bool	update_in_db
	If something important has changed about this flow (such as a newly-discovered traffic type), set this flag to `true` to force an update in the database. More...

FlowHash	hash
	Unique hash for this flow. More...

FlowHash	parent_flow
	A related or parent flow. More...

Traffic::Types	traffic_types
	Different things we've identified in this flow. More...

FlowStats	current_stats
	Current flow statistics. More...

FlowStats	total_stats
	Total statistics over the entire life of the flow. More...

VBytes	example_packet
	An example packet from this flow. More...

PktInfo	info
	Information on this flow taken from the example packet. More...

HostLookupMap	host_map
	Names and addresses of hosts, such as those discovered in DNS or HTTP flows. More...

SStr	urls
	URLs, such as those discovered in HTTP flows. More...

FlowTuple	tuple
	Flow tuple based on the first packet of the flow. More...

IPv4_ADDR	in_addr
	Inside address. More...

IPv4_ADDR	out_addr
	Outside address. More...

PORT	in_port
	Inside port. More...

PORT	out_port
	Outside port. More...

std::string	address_1_name
	Formatted name of "source" address and port, such as "10.0.1.9:58325". More...

std::string	address_2_name
	Formatted name of "destination" address and port, such as "9.8.7.6:443". More...

TrafficExams	traffic_exams
	All relevant traffic examination functions to call when a new packet arrives. More...

Detailed Description

The Flow class represents both sides of a network connection.

It includes type information which is obtained by examining packets from the flow.

Constructor & Destructor Documentation

Myra::Flow::~Flow ( void )

Destructor.

Myra::Flow::Flow ( const FlowHash hash = 0 )

Constructor.

Here is the call graph for this function:

Myra::Flow::Flow ( const Flow & rhs )

Copy constructor for insertion into std::map.

Here is the call graph for this function:

Member Function Documentation

Myra::Flow & Myra::Flow::add_packet	(	const uint8_t *	raw,
		const std::size_t	len,
		const L2::Ethertype	type
	)

Add another packet to this flow, and call the traffic exams.

Here is the call graph for this function:

Here is the caller graph for this function:

Flow& Myra::Flow::add_type ( const Myra::Traffic::Type type )

inline

Add a type to traffic_types and set update_in_db if appropriate.

Here is the call graph for this function:

Here is the caller graph for this function:

Flow& Myra::Flow::del_type ( const Myra::Traffic::Type type )

inline

Remove a type from traffic_types and set update_in_db if appropriate.

Here is the call graph for this function:

Here is the caller graph for this function:

Myra::Flow & Myra::Flow::replace_example_packet ( const Myra::PktInfo & new_info )

Replace example packet with this packet. Normally called once a flow has been classified.

Here is the caller graph for this function:

Myra::Flow & Myra::Flow::replace_example_packet	(	const uint8_t *	raw,
		const std::size_t	len,
		const L2::Ethertype	type
	)

Todo:: fix for IPv6

Here is the call graph for this function:

Flow& Myra::Flow::replace_type	(	const Myra::Traffic::Type	old_type,
		const Myra::Traffic::Type	new_type
	)

inline

Remove a type (if it exists) from traffic_types and add a new type.

Here is the call graph for this function:

Here is the caller graph for this function:

Myra::Flow & Myra::Flow::setup_port_based_traffic_exams ( void )

Last-ditch effort at identification uses simplistic port-based exams.

Here is the call graph for this function:

Here is the caller graph for this function:

Myra::Flow & Myra::Flow::setup_traffic_exams ( void )

Setup all of the relevant traffic exams for the given flow.

Here is the call graph for this function:

std::string Myra::Flow::to_string ( void ) const

inline

Use traffic_types to come up with a text string describing the flow.

Here is the call graph for this function:

Here is the caller graph for this function:

STAT Myra::Flow::total_number_of_bytes ( void ) const

inline

Get the total number of bytes in this flow.

This includes both the current number of bytes and those that have already been written to the database.

See also: Myra::Flow::current_stats; Myra::Flow::total_stats

Here is the call graph for this function:

STAT Myra::Flow::total_number_of_packets ( void ) const

inline

Get the total number of packets in this flow.

This includes both the current number of packets and those that have already been written to the database.

See also: Myra::Flow::current_stats; Myra::Flow::total_stats

Here is the call graph for this function:

Here is the caller graph for this function:

Member Data Documentation

std::string Myra::Flow::address_1_name

Formatted name of "source" address and port, such as "10.0.1.9:58325".

std::string Myra::Flow::address_2_name

Formatted name of "destination" address and port, such as "9.8.7.6:443".

FlowStats Myra::Flow::current_stats

Current flow statistics.

These stats have not yet been added to total_stats, nor have they been written to the database. These stats are regularly reset to zero by Myra::DB::record_stats() once a database flow stat record has been written out to the database. This happens approximately every second.

See also: Myra::Flow::total_number_of_bytes(); Myra::Flow::total_number_of_packets()

Myra::DB::Id Myra::Flow::db_id

Database ID for this flow in the flows table.

This value will be zero until the flow is seen by Myra::Server::flow_rollup_thread().

See also: Myra::DB::record_flow()

VBytes Myra::Flow::example_packet

An example packet from this flow.

FlowHash Myra::Flow::hash

Unique hash for this flow.

See also: Myra::hash()

HostLookupMap Myra::Flow::host_map

Names and addresses of hosts, such as those discovered in DNS or HTTP flows.

IPv4_ADDR Myra::Flow::in_addr

Inside address.

PORT Myra::Flow::in_port

Inside port.

PktInfo Myra::Flow::info

Information on this flow taken from the example packet.

IPv4_ADDR Myra::Flow::out_addr

Outside address.

PORT Myra::Flow::out_port

Outside port.

FlowHash Myra::Flow::parent_flow

A related or parent flow.

See also: Myra::FlowExpectation

FlowStats Myra::Flow::total_stats

Total statistics over the entire life of the flow.

These stats do not yet include the statistics in current_stats, since the current_stats are added to total_stats only once the flow rollup event takes place.

See also: Myra::DB::record_stats(); Myra::Flow::total_number_of_bytes(); Myra::Flow::total_number_of_packets()

TrafficExams Myra::Flow::traffic_exams

All relevant traffic examination functions to call when a new packet arrives.

This vector is modified to remove irrelevant exams as additional packets are examined.

See also: add_packet()

Traffic::Types Myra::Flow::traffic_types

Different things we've identified in this flow.

FlowTuple Myra::Flow::tuple

Flow tuple based on the first packet of the flow.

bool Myra::Flow::update_in_db

If something important has changed about this flow (such as a newly-discovered traffic type), set this flag to true to force an update in the database.

SStr Myra::Flow::urls

URLs, such as those discovered in HTTP flows.

The documentation for this class was generated from the following files:

Myra/src-traffic/Flow.hpp
Myra/src-traffic/Flow.cpp

Public Member Functions

Public Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation