Pure, bounded flow analysis over numeric flow projection packets.
Pure, bounded flow analysis over numeric flow projection packets.
(aggregate-rf {:keys [max-flows] :as opts})Return a standard 0/1/2-arity reducing function with immutable map state.
Requires positive integer :max-flows; :direction defaults to :unidir. State is {:flows {key {:packets n :captured-bytes n :wire-bytes n}} :summary {:seen n :aggregated n :skipped n}}. Invalid keys are skipped. Eligible packets require integer lengths in 0..4294967295 with caplen <= len, otherwise throw ex-info. A new key beyond the bound throws ex-info (:reason :max-flows); existing keys still update. Counters promote to arbitrary precision integers on overflow. Completion returns state unchanged. No state is retained between reductions.
Return a standard 0/1/2-arity reducing function with immutable map state.
Requires positive integer :max-flows; :direction defaults to :unidir.
State is {:flows {key {:packets n :captured-bytes n :wire-bytes n}}
:summary {:seen n :aggregated n :skipped n}}.
Invalid keys are skipped. Eligible packets require integer lengths in
0..4294967295 with caplen <= len, otherwise throw ex-info. A new key beyond
the bound throws ex-info (:reason :max-flows); existing keys still update.
Counters promote to arbitrary precision integers on overflow. Completion
returns state unchanged. No state is retained between reductions.(key packet)(key packet opts)Return a canonical six-field numeric flow key, or nil for invalid input.
Accepts flow projection packets, requiring both port keys (nil is unknown). IPv4 uses unsigned integers; IPv6 uses two signed long words. Protocol is numeric. :direction defaults to :unidir; :bidir orders endpoints by unsigned address then port, with nil before zero. IP version precedes protocol in ordering across keys. Metadata is excluded; decode-error or flow diagnostics make the input ineligible. Does not decode bytes or convert full-decode keys.
Return a canonical six-field numeric flow key, or nil for invalid input. Accepts flow projection packets, requiring both port keys (nil is unknown). IPv4 uses unsigned integers; IPv6 uses two signed long words. Protocol is numeric. :direction defaults to :unidir; :bidir orders endpoints by unsigned address then port, with nil before zero. IP version precedes protocol in ordering across keys. Metadata is excluded; decode-error or flow diagnostics make the input ineligible. Does not decode bytes or convert full-decode keys.
(top-n result {:keys [metric n] :or {metric :packets n 10}})Return a vector of {:flow canonical-key :packets n :captured-bytes n :wire-bytes n}.
:metric defaults to :packets; also accepts :captured-bytes or :wire-bytes. :n defaults to 10 and must be a nonnegative integer. Sorts descending by metric, then ascending by canonical key (version, protocol, endpoints). Ties are independent of input order, including mixed IPv4/IPv6 and nil ports. Accepts aggregate-rf results; exact sorting costs O(F log F) for F flows.
Return a vector of {:flow canonical-key :packets n :captured-bytes n :wire-bytes n}.
:metric defaults to :packets; also accepts :captured-bytes or :wire-bytes.
:n defaults to 10 and must be a nonnegative integer. Sorts descending by
metric, then ascending by canonical key (version, protocol, endpoints).
Ties are independent of input order, including mixed IPv4/IPv6 and nil ports.
Accepts aggregate-rf results; exact sorting costs O(F log F) for F flows.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |