gurix
50e047438d
- Add constants for Mail (IMAP, POP3, SMTP-sub), File Transfer (FTP, SMB, TFTP) - Add constants for Remote Access (RDP, Telnet, VNC), Database (MySQL, PostgreSQL, Redis, MongoDB) - Add constants for Discovery (mDNS, SSDP, SNMP), VoIP (SIP), Web (QUIC) - Add constants for Infrastructure extension (LDAP, Kerberos, Syslog) - Update AllClasses() to return 32 classes (LDAP/Kerberos/Syslog excluded per D-01)
107 lines
3.3 KiB
Go
107 lines
3.3 KiB
Go
package classify
|
|
|
|
import "time"
|
|
|
|
// TrafficClass represents a classified network traffic category.
|
|
type TrafficClass string
|
|
|
|
const (
|
|
ClassICMP TrafficClass = "ICMP"
|
|
ClassDNS TrafficClass = "DNS"
|
|
ClassHTTPS TrafficClass = "HTTPS"
|
|
ClassHTTP TrafficClass = "HTTP"
|
|
ClassSSH TrafficClass = "SSH"
|
|
ClassSMTP TrafficClass = "SMTP"
|
|
ClassNTP TrafficClass = "NTP"
|
|
ClassDHCP TrafficClass = "DHCP"
|
|
ClassOtherTCP TrafficClass = "other-TCP"
|
|
ClassOtherUDP TrafficClass = "other-UDP"
|
|
// D-04: ClassUnknown replaced by 4 hash-bucketed classes for distinct tones
|
|
ClassUnknown1 TrafficClass = "unknown-1"
|
|
ClassUnknown2 TrafficClass = "unknown-2"
|
|
ClassUnknown3 TrafficClass = "unknown-3"
|
|
ClassUnknown4 TrafficClass = "unknown-4"
|
|
|
|
// --- Mail (PROTO-01) ---
|
|
ClassIMAP TrafficClass = "IMAP"
|
|
ClassPOP3 TrafficClass = "POP3"
|
|
ClassSMTPSub TrafficClass = "SMTP-sub" // D-04: separate from ClassSMTP (port 25)
|
|
|
|
// --- File Transfer (PROTO-02) ---
|
|
ClassFTP TrafficClass = "FTP"
|
|
ClassSMB TrafficClass = "SMB"
|
|
ClassTFTP TrafficClass = "TFTP"
|
|
|
|
// --- Remote Access (PROTO-03) ---
|
|
ClassRDP TrafficClass = "RDP"
|
|
ClassTelnet TrafficClass = "Telnet"
|
|
ClassVNC TrafficClass = "VNC"
|
|
|
|
// --- Database (PROTO-04) ---
|
|
ClassMySQL TrafficClass = "MySQL"
|
|
ClassPostgreSQL TrafficClass = "PostgreSQL"
|
|
ClassRedis TrafficClass = "Redis"
|
|
ClassMongoDB TrafficClass = "MongoDB"
|
|
|
|
// --- Discovery (PROTO-05) ---
|
|
ClassMDNS TrafficClass = "mDNS"
|
|
ClassSSDP TrafficClass = "SSDP"
|
|
ClassSNMP TrafficClass = "SNMP"
|
|
|
|
// --- VoIP (PROTO-06) ---
|
|
ClassSIP TrafficClass = "SIP"
|
|
|
|
// --- Web extension (PROTO-07) ---
|
|
ClassQUIC TrafficClass = "QUIC"
|
|
|
|
// --- Infrastructure extension (PROTO-08, D-01: no ClassFreqConfigs until Phase 11) ---
|
|
ClassLDAP TrafficClass = "LDAP"
|
|
ClassKerberos TrafficClass = "Kerberos"
|
|
ClassSyslog TrafficClass = "Syslog"
|
|
)
|
|
|
|
// AllClasses returns all known traffic classes in display order.
|
|
// Excludes ClassLDAP, ClassKerberos, and ClassSyslog — these have constants and rules
|
|
// but no ClassFreqConfigs entries until Phase 11, so they must not appear here
|
|
// (TestAllClassesHaveConfig in synth/config_test.go enforces the invariant).
|
|
func AllClasses() []TrafficClass {
|
|
return []TrafficClass{
|
|
// Infrastructure
|
|
ClassICMP, ClassDNS, ClassNTP, ClassDHCP,
|
|
ClassMDNS, ClassSSDP, ClassSNMP,
|
|
// Web
|
|
ClassHTTPS, ClassHTTP, ClassQUIC,
|
|
// Mail
|
|
ClassSMTP, ClassIMAP, ClassPOP3, ClassSMTPSub,
|
|
// Remote Access
|
|
ClassSSH, ClassRDP, ClassTelnet, ClassVNC,
|
|
// File Transfer
|
|
ClassFTP, ClassSMB, ClassTFTP,
|
|
// Database
|
|
ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB,
|
|
// VoIP
|
|
ClassSIP,
|
|
// Unknown / catch-all
|
|
ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
|
|
ClassOtherTCP, ClassOtherUDP,
|
|
}
|
|
}
|
|
|
|
// ClassifiedPacket pairs a raw packet's classification result with metadata.
|
|
type ClassifiedPacket struct {
|
|
Class TrafficClass
|
|
SrcPort uint16
|
|
DstPort uint16
|
|
Protocol string // "tcp", "udp", "icmp"
|
|
Length int
|
|
Timestamp time.Time // Set from pkt.Metadata().CaptureInfo.Timestamp; zero in live mode (D-01)
|
|
}
|
|
|
|
// WindowSnapshot holds aggregated packet counts for a time window.
|
|
// This is the contract between the aggregation stage and future audio synthesis (Phase 2).
|
|
type WindowSnapshot struct {
|
|
Counts map[TrafficClass]int64
|
|
TotalPackets int64
|
|
WindowIndex int
|
|
}
|