---
phase: 10-classification-layer
plan: 01
subsystem: classify
tags: [classification, protocols, constants, rules, v1.2]
dependency_graph:
  requires: [phase-09-frequency-design]
  provides: [21-new-traffic-class-constants, 30-new-port-matching-rules, updated-AllClasses]
  affects: [classify/types.go, classify/rules.go]
tech_stack:
  added: []
  patterns: [first-match-wins ordered rules, family-grouped constants]
key_files:
  created: []
  modified:
    - classify/types.go
    - classify/rules.go
decisions:
  - LDAP, Kerberos, and Syslog excluded from AllClasses() per D-01 — no ClassFreqConfigs entries until Phase 11; exclusion keeps TestAllClassesHaveConfig green
  - Plain/TLS variants share a single class constant per D-03 (e.g. IMAP 143 and IMAPS 993 both map to ClassIMAP)
  - SMTP-sub (port 587) is a separate class from SMTP (port 25) per D-04
  - QUIC uses Protocol "udp" with DstPort 443 to distinguish from HTTPS (tcp/443)
  - All 30 new specific-port rules placed before catch-alls per D-06
metrics:
  duration: "3 min"
  completed: "2026-03-27"
  tasks_completed: 2
  files_modified: 2
requirements_satisfied:
  - PROTO-01
  - PROTO-02
  - PROTO-03
  - PROTO-04
  - PROTO-05
  - PROTO-06
  - PROTO-07
  - PROTO-08
---

# Phase 10 Plan 1: Classification Layer — Constants and Rules Summary

Added 21 new TrafficClass constants (IMAP, POP3, SMTP-sub, FTP, SMB, TFTP, RDP, Telnet, VNC, MySQL, PostgreSQL, Redis, MongoDB, mDNS, SSDP, SNMP, SIP, QUIC, LDAP, Kerberos, Syslog) and 30 new port-matching rules to the classify package, expanding traffic classification from 14 to 35 classes (32 in AllClasses(), 3 deferred to Phase 11).

## Tasks Completed

| Task | Name | Commit | Files |
|------|------|--------|-------|
| 1 | Add 21 new TrafficClass constants and update AllClasses() | 50e0474 | classify/types.go |
| 2 | Add 30 new port-matching rules to DefaultRules | cd8593e | classify/rules.go |

## What Was Done

**Task 1** added 21 new `TrafficClass` constants to `classify/types.go`, grouped by protocol family with comments:
- Mail: `ClassIMAP`, `ClassPOP3`, `ClassSMTPSub`
- File Transfer: `ClassFTP`, `ClassSMB`, `ClassTFTP`
- Remote Access: `ClassRDP`, `ClassTelnet`, `ClassVNC`
- Database: `ClassMySQL`, `ClassPostgreSQL`, `ClassRedis`, `ClassMongoDB`
- Discovery: `ClassMDNS`, `ClassSSDP`, `ClassSNMP`
- VoIP: `ClassSIP`
- Web extension: `ClassQUIC`
- Infrastructure extension (Phase 11 deferred): `ClassLDAP`, `ClassKerberos`, `ClassSyslog`

`AllClasses()` updated to return 32 classes — the 14 existing classes plus 18 new ones. `ClassLDAP`, `ClassKerberos`, and `ClassSyslog` are intentionally excluded because their `ClassFreqConfigs` entries do not exist until Phase 11.

**Task 2** expanded `DefaultRules` in `classify/rules.go` from 12 to 42 rules. All 30 new rules are specific-port rules placed before the catch-all entries. Key behaviors:
- Plain/TLS variants map to the same class (IMAP 143/993, POP3 110/995, LDAP 389/636, SIP 5060/5061 tcp+udp, FTP 20/21)
- QUIC uses `Protocol: "udp", DstPort: 443` — distinct from HTTPS at `tcp/443`
- Catch-alls `{tcp, 0, ClassOtherTCP}` and `{udp, 0, ClassOtherUDP}` remain as the final two entries

## Verification Results

- `go build ./classify/...` — clean compilation, no errors
- `go test -count=1 ./...` — all 7 packages pass (classify, synth, aggregate, capture, cmd, config, encode)
- `TestAllClassesHaveConfig` — PASS (32 AllClasses entries all have ClassFreqConfigs entries)
- `TestClassFreqConfigsMatchAllClasses` — PASS
- `TestFrequenciesInRange` — PASS
- `TestGroupFieldPopulated` — PASS

Final counts:
- Total TrafficClass constants: 35 (14 existing + 21 new)
- AllClasses() entries: 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded)
- DefaultRules entries: 42 (12 existing + 30 new)

## Deviations from Plan

None — plan executed exactly as written.

## Known Stubs

None.

## Self-Check: PASSED

- classify/types.go exists with 35 TrafficClass constants including ClassIMAP, ClassMongoDB, ClassQUIC, ClassSyslog
- classify/rules.go exists with 42 rules including DstPort 3306 ClassMySQL, DstPort 27017 ClassMongoDB
- AllClasses() returns 32 classes; does NOT include ClassLDAP, ClassKerberos, ClassSyslog
- Commits 50e0474 and cd8593e exist
- `go test -count=1 ./...` all green