PcapFileEx.Flows.UDP.Collector (pcap_file_ex v0.5.5)

View Source

Collects UDP datagrams into flows grouped by destination.

UDP flows are grouped by server (destination) endpoint only, using from: :any pattern since datagrams may come from any source.

Example

{:ok, flows} = UDP.Collector.collect(packets)

Enum.each(flows, fn flow ->
  IO.puts("UDP to #{flow.flow.server}: #{length(flow.datagrams)} datagrams")
end)

Summary

Types

packet()

Functions

collect(packets, opts \\ [])

Collects UDP packets into flows grouped by destination.

extract(pcap_path, opts \\ [])

Extracts UDP packets from PCAP file.

Types

packet()

@type packet() :: %{
  src_ip: tuple(),
  src_port: non_neg_integer(),
  dst_ip: tuple(),
  dst_port: non_neg_integer(),
  payload: binary(),
  timestamp: DateTime.t()
}

Functions

collect(packets, opts \\ [])

@spec collect(
  [packet()],
  keyword()
) :: {:ok, [PcapFileEx.Flows.UDP.Flow.t()]}

Collects UDP packets into flows grouped by destination.

Parameters

  • packets - List of UDP packet maps
  • opts - Options:
    • :hosts_map - Map of IP strings to hostnames
    • :decoders - List of custom decoder specs (see PcapFileEx.Flows.Decoder)
    • :keep_binary - When true, preserve original binary in payload_binary when custom decoders are invoked (default: false)

Returns

{:ok, flows} where flows is a list of UDP.Flow.t()

Example

packets = [
  %{src_ip: {10,0,0,1}, src_port: 54321, dst_ip: {10,0,0,2}, dst_port: 5005,
    payload: <<1,2,3>>, timestamp: ~U[2024-01-01 00:00:00Z]},
  ...
]

{:ok, flows} = UDP.Collector.collect(packets, hosts_map: %{"10.0.0.2" => "metrics"})

extract(pcap_path, opts \\ [])

@spec extract(
  Path.t(),
  keyword()
) :: {:ok, [PcapFileEx.Flows.UDP.Flow.t()]} | {:error, term()}

Extracts UDP packets from PCAP file.

Parameters

  • pcap_path - Path to PCAP/PCAPNG file
  • opts - Options:
    • :port - Filter to specific UDP port
    • :hosts_map - Map of IP strings to hostnames
    • :decoders - List of custom decoder specs (see PcapFileEx.Flows.Decoder)
    • :keep_binary - When true, preserve original binary in payload_binary when custom decoders are invoked (default: false)

Returns

{:ok, flows} where flows is a list of UDP.Flow.t()