gurix
52c601019b
- Add Timestamp time.Time field to ClassifiedPacket (classify/types.go) - Create capture/bpf.go: ValidateBPFFilter and CompileSoftwareBPF - Create capture/pcap_reader.go: ReadPcapFile with optional software BPF filter - Update OpenCapture and StartCapture to accept filter string param - Update cmd/netsynth/main.go to pass empty filter to StartCapture - All new tests pass; existing tests unaffected
52 lines
1.6 KiB
Go
52 lines
1.6 KiB
Go
package classify
|
|
|
|
import "time"
|
|
|
|
// TrafficClass represents a classified network traffic category.
|
|
type TrafficClass string
|
|
|
|
const (
|
|
ClassICMP TrafficClass = "ICMP"
|
|
ClassDNS TrafficClass = "DNS"
|
|
ClassHTTPS TrafficClass = "HTTPS"
|
|
ClassHTTP TrafficClass = "HTTP"
|
|
ClassSSH TrafficClass = "SSH"
|
|
ClassSMTP TrafficClass = "SMTP"
|
|
ClassNTP TrafficClass = "NTP"
|
|
ClassDHCP TrafficClass = "DHCP"
|
|
ClassOtherTCP TrafficClass = "other-TCP"
|
|
ClassOtherUDP TrafficClass = "other-UDP"
|
|
// D-04: ClassUnknown replaced by 4 hash-bucketed classes for distinct tones
|
|
ClassUnknown1 TrafficClass = "unknown-1"
|
|
ClassUnknown2 TrafficClass = "unknown-2"
|
|
ClassUnknown3 TrafficClass = "unknown-3"
|
|
ClassUnknown4 TrafficClass = "unknown-4"
|
|
)
|
|
|
|
// AllClasses returns all known traffic classes in display order.
|
|
func AllClasses() []TrafficClass {
|
|
return []TrafficClass{
|
|
ClassICMP, ClassDNS, ClassHTTPS, ClassHTTP, ClassSSH,
|
|
ClassSMTP, ClassNTP, ClassDHCP, ClassOtherTCP, ClassOtherUDP,
|
|
ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
|
|
}
|
|
}
|
|
|
|
// ClassifiedPacket pairs a raw packet's classification result with metadata.
|
|
type ClassifiedPacket struct {
|
|
Class TrafficClass
|
|
SrcPort uint16
|
|
DstPort uint16
|
|
Protocol string // "tcp", "udp", "icmp"
|
|
Length int
|
|
Timestamp time.Time // Set from pkt.Metadata().CaptureInfo.Timestamp; zero in live mode (D-01)
|
|
}
|
|
|
|
// WindowSnapshot holds aggregated packet counts for a time window.
|
|
// This is the contract between the aggregation stage and future audio synthesis (Phase 2).
|
|
type WindowSnapshot struct {
|
|
Counts map[TrafficClass]int64
|
|
TotalPackets int64
|
|
WindowIndex int
|
|
}
|