/// <summary>
/// Implements a function to be used in the Count Frame conversation processor.
/// </summary>
/// <param name="flowKey"></param>
/// <param name="frames"></param>
/// <returns></returns>
private (string key, int frames, int octets, int ip, int tcp, int udp) CountFrames(FlowKey flowKey, System.Collections.Generic.IEnumerable <Memory <byte> > frames)
{
(int octets, int ip, int tcp, int udp) GetFrameSize(Memory <byte> memory)
{
var meta = default(FrameMetadata);
var bytes = FrameMetadata.FromBytes(memory.Span, ref meta);
var packet = PacketDotNet.Packet.ParsePacket((PacketDotNet.LinkLayers)meta.LinkLayer, bytes.ToArray());
return(meta.OriginalLength,
packet.Extract <PacketDotNet.InternetPacket>() != null ? 1 : 0,
packet.Extract <PacketDotNet.TcpPacket>() != null ? 1 : 0,
packet.Extract <PacketDotNet.UdpPacket>() != null ? 1 : 0
);
}
var framesList = frames.ToList();
// intentionally it is computed in this inefficient way to test
// the implementated iteration over the input collection
return(flowKey.ToString(), framesList.Count,
framesList.Sum(x => GetFrameSize(x).octets),
framesList.Sum(x => GetFrameSize(x).ip),
framesList.Sum(x => GetFrameSize(x).tcp),
framesList.Sum(x => GetFrameSize(x).udp)
);
}
void Generate()
{
void onNextFrame(ref ulong key, ref SpanByte value)
{
FrameKey frameKey = new FrameKey(key);
FrameMetadata frameMetadata = default;
var frameBytes = FrameMetadata.FromBytes(value.AsSpan(), ref frameMetadata);
_observer.OnNext(_processor(ref frameKey, ref frameMetadata, frameBytes));
}
_framesStore.ProcessEntries(onNextFrame, _cancel.Token);
_observer.OnCompleted();
}
public TTarget Invoke(FlowKey flowKey, IEnumerable <Memory <byte> > frames)
{
var firstTicks = _windowStart.Ticks;
var lastTicks = firstTicks + _duration.Ticks;
bool IsInWindow(Memory <byte> frame)
{
FrameMetadata frameMetadata = default;
FrameMetadata.FromBytes(frame.Span, ref frameMetadata);
return(frameMetadata.Ticks >= firstTicks && frameMetadata.Ticks < lastTicks);
}
return(_processor.Invoke(flowKey, frames.Where(IsInWindow)));
}
public ConversationRecord <TData> Invoke(FlowKey flowKey, IEnumerable <Memory <byte> > frames)
{
var fwdPackets = new List <MetaPacket>();
var revPackets = new List <MetaPacket>();
var forwardKeyHash = flowKey.GetHashCode64();
var meta = new FrameMetadata();
FlowMetrics fwdMetrics = new FlowMetrics();
FlowMetrics revMetrics = new FlowMetrics();
DateTime? firstTimestamp = null;
foreach (var frame in frames)
{
var buffer = FrameMetadata.FromBytes(frame.Span, ref meta);
if (firstTimestamp == null)
{
firstTimestamp = new DateTime(meta.Ticks);
}
var packet = Packet.ParsePacket((LinkLayers)meta.LinkLayer, buffer.ToArray());
if (meta.FlowKeyHash == forwardKeyHash)
{
AddPacket(fwdPackets, ref fwdMetrics, ref meta, packet);
}
else
{
AddPacket(revPackets, ref revMetrics, ref meta, packet);
}
}
if (firstTimestamp != null)
{
// adjust metrics:
AdjustMetrics(ref fwdMetrics, firstTimestamp.Value);
AdjustMetrics(ref revMetrics, firstTimestamp.Value);
}
return(new ConversationRecord <TData>()
{
Key = flowKey,
ForwardMetrics = fwdMetrics,
ReverseMetrics = revMetrics,
Data = Invoke(ref flowKey, ref fwdMetrics, ref revMetrics, fwdPackets, revPackets)
});
}
