gurix
1556ce83e9
- Add 21 new ClassFreqConfigs entries covering mDNS/SSDP/SNMP/QUIC/IMAP/POP3/SMTPSub/RDP/Telnet/VNC/FTP/SMB/TFTP/MySQL/PostgreSQL/Redis/MongoDB/SIP/LDAP/Kerberos/Syslog - Update AllClasses() to return 35 entries (add LDAP/Kerberos/Syslog in Infrastructure section) - Remove outdated Phase 11 exclusion comment from AllClasses() doc comment
105 lines
3.1 KiB
Go
105 lines
3.1 KiB
Go
package classify
|
|
|
|
import "time"
|
|
|
|
// TrafficClass represents a classified network traffic category.
|
|
type TrafficClass string
|
|
|
|
const (
|
|
ClassICMP TrafficClass = "ICMP"
|
|
ClassDNS TrafficClass = "DNS"
|
|
ClassHTTPS TrafficClass = "HTTPS"
|
|
ClassHTTP TrafficClass = "HTTP"
|
|
ClassSSH TrafficClass = "SSH"
|
|
ClassSMTP TrafficClass = "SMTP"
|
|
ClassNTP TrafficClass = "NTP"
|
|
ClassDHCP TrafficClass = "DHCP"
|
|
ClassOtherTCP TrafficClass = "other-TCP"
|
|
ClassOtherUDP TrafficClass = "other-UDP"
|
|
// D-04: ClassUnknown replaced by 4 hash-bucketed classes for distinct tones
|
|
ClassUnknown1 TrafficClass = "unknown-1"
|
|
ClassUnknown2 TrafficClass = "unknown-2"
|
|
ClassUnknown3 TrafficClass = "unknown-3"
|
|
ClassUnknown4 TrafficClass = "unknown-4"
|
|
|
|
// --- Mail (PROTO-01) ---
|
|
ClassIMAP TrafficClass = "IMAP"
|
|
ClassPOP3 TrafficClass = "POP3"
|
|
ClassSMTPSub TrafficClass = "SMTP-sub" // D-04: separate from ClassSMTP (port 25)
|
|
|
|
// --- File Transfer (PROTO-02) ---
|
|
ClassFTP TrafficClass = "FTP"
|
|
ClassSMB TrafficClass = "SMB"
|
|
ClassTFTP TrafficClass = "TFTP"
|
|
|
|
// --- Remote Access (PROTO-03) ---
|
|
ClassRDP TrafficClass = "RDP"
|
|
ClassTelnet TrafficClass = "Telnet"
|
|
ClassVNC TrafficClass = "VNC"
|
|
|
|
// --- Database (PROTO-04) ---
|
|
ClassMySQL TrafficClass = "MySQL"
|
|
ClassPostgreSQL TrafficClass = "PostgreSQL"
|
|
ClassRedis TrafficClass = "Redis"
|
|
ClassMongoDB TrafficClass = "MongoDB"
|
|
|
|
// --- Discovery (PROTO-05) ---
|
|
ClassMDNS TrafficClass = "mDNS"
|
|
ClassSSDP TrafficClass = "SSDP"
|
|
ClassSNMP TrafficClass = "SNMP"
|
|
|
|
// --- VoIP (PROTO-06) ---
|
|
ClassSIP TrafficClass = "SIP"
|
|
|
|
// --- Web extension (PROTO-07) ---
|
|
ClassQUIC TrafficClass = "QUIC"
|
|
|
|
// --- Infrastructure extension (PROTO-08) ---
|
|
ClassLDAP TrafficClass = "LDAP"
|
|
ClassKerberos TrafficClass = "Kerberos"
|
|
ClassSyslog TrafficClass = "Syslog"
|
|
)
|
|
|
|
// AllClasses returns all known traffic classes in display order.
|
|
func AllClasses() []TrafficClass {
|
|
return []TrafficClass{
|
|
// Infrastructure
|
|
ClassICMP, ClassDNS, ClassNTP, ClassDHCP,
|
|
ClassMDNS, ClassSSDP, ClassSNMP,
|
|
ClassLDAP, ClassKerberos, ClassSyslog,
|
|
// Web
|
|
ClassHTTPS, ClassHTTP, ClassQUIC,
|
|
// Mail
|
|
ClassSMTP, ClassIMAP, ClassPOP3, ClassSMTPSub,
|
|
// Remote Access
|
|
ClassSSH, ClassRDP, ClassTelnet, ClassVNC,
|
|
// File Transfer
|
|
ClassFTP, ClassSMB, ClassTFTP,
|
|
// Database
|
|
ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB,
|
|
// VoIP
|
|
ClassSIP,
|
|
// Unknown / catch-all
|
|
ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
|
|
ClassOtherTCP, ClassOtherUDP,
|
|
}
|
|
}
|
|
|
|
// ClassifiedPacket pairs a raw packet's classification result with metadata.
|
|
type ClassifiedPacket struct {
|
|
Class TrafficClass
|
|
SrcPort uint16
|
|
DstPort uint16
|
|
Protocol string // "tcp", "udp", "icmp"
|
|
Length int
|
|
Timestamp time.Time // Set from pkt.Metadata().CaptureInfo.Timestamp; zero in live mode (D-01)
|
|
}
|
|
|
|
// WindowSnapshot holds aggregated packet counts for a time window.
|
|
// This is the contract between the aggregation stage and future audio synthesis (Phase 2).
|
|
type WindowSnapshot struct {
|
|
Counts map[TrafficClass]int64
|
|
TotalPackets int64
|
|
WindowIndex int
|
|
}
|