suricata
TcpStream_ Struct Reference

#include <stream-tcp-private.h>

Collaboration diagram for TcpStream_:

Data Fields

uint16_t flags:12
 
uint16_t wscale:4
 
uint8_t os_policy
 
uint8_t tcp_flags
 
uint32_t isn
 
uint32_t next_seq
 
uint32_t last_ack
 
uint32_t next_win
 
uint32_t window
 
uint32_t last_ts
 
uint32_t last_pkt_ts
 
uint32_t base_seq
 
uint32_t app_progress_rel
 
uint32_t raw_progress_rel
 
uint32_t log_progress_rel
 
uint32_t min_inspect_depth
 
StreamingBuffer sb
 
struct TCPSEG seg_tree
 
uint32_t segs_right_edge
 
uint32_t sack_size
 
struct TCPSACK sack_tree
 

Detailed Description

Definition at line 94 of file stream-tcp-private.h.

Field Documentation

uint32_t TcpStream_::app_progress_rel

app-layer progress relative to STREAM_BASE_OFFSET

Definition at line 114 of file stream-tcp-private.h.

Referenced by StreamTcpPruneSession().

uint32_t TcpStream_::last_pkt_ts

Time of last seen packet for this stream (needed for PAWS update) This will be used to validate the last_ts, when connection has been idle for longer time.(RFC 1323)

Definition at line 108 of file stream-tcp-private.h.

Referenced by StreamTcpThreadDeinit().

uint32_t TcpStream_::last_ts

Time stamp (TSVAL) of the last seen packet for this stream

Definition at line 107 of file stream-tcp-private.h.

Referenced by StreamTcpThreadDeinit().

uint32_t TcpStream_::log_progress_rel

streaming logger progress relative to STREAM_BASE_OFFSET

Definition at line 116 of file stream-tcp-private.h.

Referenced by StreamTcpPruneSession().

uint32_t TcpStream_::min_inspect_depth

min inspect size set by the app layer, to make sure enough data remains available for inspection together with app layer buffers

Definition at line 118 of file stream-tcp-private.h.

Referenced by StreamReassembleRawUpdateProgress(), StreamTcpReassembleInsertSegment(), and StreamTcpReassemblySetMinInspectDepth().

uint32_t TcpStream_::next_seq
uint32_t TcpStream_::next_win

next max seq within window

Definition at line 104 of file stream-tcp-private.h.

Referenced by StreamTcpSackUpdatePacket(), and StreamTcpThreadDeinit().

uint8_t TcpStream_::os_policy

target based OS policy used for reassembly and handling packets

Definition at line 98 of file stream-tcp-private.h.

Referenced by StreamTcpReassembleHandleSegmentHandleData(), StreamTcpSetOSPolicy(), StreamTcpThreadDeinit(), and TcpSegmentCompare().

uint32_t TcpStream_::raw_progress_rel

raw reassembly progress relative to STREAM_BASE_OFFSET

Definition at line 115 of file stream-tcp-private.h.

Referenced by StreamReassembleRawUpdateProgress(), and StreamTcpPruneSession().

uint32_t TcpStream_::sack_size

combined size of the SACK ranges currently in our tree. Updated at INSERT/REMOVE time.

Definition at line 125 of file stream-tcp-private.h.

Referenced by StreamTcpSackFreeList(), StreamTcpSackPruneList(), and TcpSackCompare().

struct TCPSACK TcpStream_::sack_tree

red back tree of TCP SACK records.

Definition at line 127 of file stream-tcp-private.h.

Referenced by StreamTcpSackFreeList(), StreamTcpSackPruneList(), and TcpSackCompare().

uint32_t TcpStream_::segs_right_edge

Definition at line 123 of file stream-tcp-private.h.

Referenced by TcpSegmentCompare().

uint8_t TcpStream_::tcp_flags

TCP flags seen

Definition at line 99 of file stream-tcp-private.h.

Referenced by StreamTcpFreeConfig(), and StreamTcpPacket().

uint32_t TcpStream_::window
uint16_t TcpStream_::wscale

wscale setting in this direction, 4 bits as max val is 15

Definition at line 97 of file stream-tcp-private.h.


The documentation for this struct was generated from the following file: