PcapFileEx.Flows.UDP.Flow (pcap_file_ex v0.5.5)

View Source

A UDP flow containing datagrams.

Groups UDP datagrams by destination (server) endpoint. Unlike HTTP flows, UDP flows use from: :any because datagrams are grouped by server only, regardless of source.

Fields

  • flow - The base Flow identity (protocol, endpoints, display fields)
  • datagrams - List of UDP.Datagram structs
  • stats - Aggregate statistics for this flow

UDP Grouping

UDP datagrams are grouped by destination (server) IP:port only. All datagrams to the same server form a single flow:

%Flow{
  protocol: :udp,
  from: :any,                          # Datagrams may come from any source
  server: "metrics-collector:5005",
  client: nil,
  client_endpoint: nil
}

Examples

# Get all datagrams to a specific server
result.udp
|> Enum.filter(fn f -> f.flow.server == "metrics-collector:5005" end)
|> Enum.flat_map(& &1.datagrams)

# Calculate total bytes to each UDP server
result.udp
|> Enum.map(fn f -> {f.flow.server, f.stats.byte_count} end)

Summary

Types

t()

Functions

add_datagram(udp_flow, datagram)

Adds a datagram to the flow.

finalize(udp_flow)

Finalizes the flow by computing relative offsets for all datagrams.

new(flow)

Creates a new UDP flow.

Types

t()

@type t() :: %PcapFileEx.Flows.UDP.Flow{
  datagrams: [PcapFileEx.Flows.UDP.Datagram.t()],
  flow: PcapFileEx.Flow.t(),
  stats: PcapFileEx.Flows.Stats.t()
}

Functions

add_datagram(udp_flow, datagram)

@spec add_datagram(t(), PcapFileEx.Flows.UDP.Datagram.t()) :: t()

Adds a datagram to the flow.

Parameters

  • udp_flow - The UDP flow
  • datagram - The datagram to add

finalize(udp_flow)

@spec finalize(t()) :: t()

Finalizes the flow by computing relative offsets for all datagrams.

Called after all datagrams have been added.

new(flow)

@spec new(PcapFileEx.Flow.t()) :: t()

Creates a new UDP flow.

Parameters

  • flow - The base Flow identity (should have protocol: :udp)

Examples

alias PcapFileEx.{Flow, Endpoint}
alias PcapFileEx.Flows.UDP

server = Endpoint.new("10.0.0.2", 5005, "metrics-collector")
flow = Flow.new(:udp, nil, server)
udp_flow = UDP.Flow.new(flow)