SSF.OS.NetFlow.Filter
Class FilterPlayer

java.lang.Object
  |
  +--SSF.OS.NetFlow.Filter.FilterPlayer

All Implemented Interfaces:

StreamInterface

Direct Known Subclasses:

Analyzer, NHIDemuxer

public class FilterPlayer

extends java.lang.Object

implements StreamInterface

It reads records from the net flow data file, pass all the records through a filter. It's NOT an extension of SSF.Util.Streams.BasicPlayer, but it might be in the future release.

Field Summary

protected Filter	filter filter is not from BasicPlayer
protected java.util.Hashtable	sourceDictionary in BasicPlayer, it's private member
protected java.lang.String	streamID
protected java.util.Hashtable	typeDictionary in BasicPlayer, it's private member

Constructor Summary

FilterPlayer(java.lang.String streamID)

Method Summary

protected void	addSource(java.lang.String spec) The method that will be called when a record of "source nhi" announcement is met in the inputStream.
protected void	addType(java.lang.String spec) The method that will be called when a record of "type" announcement is met in the inputStream.
void	assignFilter(Filter pFilter)
void	connectRead(java.lang.String url) Connect this stream to a data source at the given URL.
void	connectWrite(java.lang.String url) Connect this stream to a data sink at the given URL.
void	disconnect() Signal that no more records are to be received (if reading) or sent (if writing).
int	getRecordSourceCode(java.lang.String name) Return the integer code associated with the user-defined record source string in this record stream.
java.lang.String	getRecordSourceString(int id) Return the arbitrary-length String identifying the user-defined source (writer) ID associated with a given code in this record stream.
int	getRecordTypeCode(java.lang.String name) Return the integer code associated with the user-defined record type string in this record stream.
java.lang.String	getRecordTypeString(int id) Return the arbitrary-length String identifying the user-defined record type associated with a given code in this record stream.
boolean	isConnected() Return true if this stream has been successfully connected to a data source or sink, and not disconnected.
static void	main(java.lang.String[] args) usage: java FilterPlayer <filter config> <flow data file> <stream name>
int	receive(int type_code, int source_code, double timestamp, byte[] buf, int offset, int length) operations after a record of netflow stream is met if the record is NOT a netflow record, this function should be overloaded.
int	send(int type_code, int source_code, double timestamp) Return the same value (zero for success, nonzero for failure) that would be returned by a send with the given header information and actual payload data, assuming no IOExceptions etc.
int	send(int type_code, int source_code, double timestamp, byte[] bytes, int offset, int length) Send a single record on the data stream.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

filter

protected Filter filter

filter is not from BasicPlayer

streamID

protected java.lang.String streamID

sourceDictionary

protected java.util.Hashtable sourceDictionary

in BasicPlayer, it's private member

typeDictionary

protected java.util.Hashtable typeDictionary

in BasicPlayer, it's private member

Constructor Detail

FilterPlayer

public FilterPlayer(java.lang.String streamID)

Method Detail

assignFilter

public void assignFilter(Filter pFilter)

connectWrite

public void connectWrite(java.lang.String url)
                  throws streamException

Description copied from interface: StreamInterface

Connect this stream to a data sink at the given URL. Then call send() several times to inject records into the stream. Call disconnect() to signal that no more records will be written.

Specified by:

connectWrite in interface StreamInterface

streamException

disconnect

public void disconnect()

Description copied from interface: StreamInterface

Signal that no more records are to be received (if reading) or sent (if writing). A stream may automatically disconnect under certain conditions.

Specified by:

disconnect in interface StreamInterface

connectRead

public void connectRead(java.lang.String url)
                 throws streamException

Description copied from interface: StreamInterface

Connect this stream to a data source at the given URL. Your receive() method will be called back each time a record is received. Call disconnect() to signal that you wish to receive no more records.

Specified by:

connectRead in interface StreamInterface

streamException

send

public int send(int type_code,
                int source_code,
                double timestamp,
                byte[] bytes,
                int offset,
                int length)

Description copied from interface: StreamInterface

Send a single record on the data stream. The type_code and source_code identify the record type and source (writer) uniquely. Obtain their values by calling lookupRecordTypeCode and lookupRecordSourceCode, respectively.

These codes are not portable across implementations, or even across runs within the same implementation; they are used for efficiency purposes to minimize the overhead associated with constructing, sending, receiving, and interpreting Strings. Returns zero if a record was sent, nonzero if no record was sent (due to error, suppression due to filtering, or any other cause).

Specified by:

send in interface StreamInterface

send

public int send(int type_code,
                int source_code,
                double timestamp)

Description copied from interface: StreamInterface

Return the same value (zero for success, nonzero for failure) that would be returned by a send with the given header information and actual payload data, assuming no IOExceptions etc.

Many source-side filtering schemes will suppress sends of records that match given profiles for record types, points of origin, or intervals of time. This standard inquiry method allows a savvy sender to avoid the overhead of preparing a bufferful of bytes that will simply be ignored anyway. First test the waters with a no-payload send(), and if it returns success (zero), prepare the bytes and call the full version of send().

Specified by:

send in interface StreamInterface

isConnected

public boolean isConnected()

Description copied from interface: StreamInterface

Return true if this stream has been successfully connected to a data source or sink, and not disconnected.

Specified by:

isConnected in interface StreamInterface

getRecordTypeString

public java.lang.String getRecordTypeString(int id)

Description copied from interface: StreamInterface

Return the arbitrary-length String identifying the user-defined record type associated with a given code in this record stream. Returns null if no String has been associated with the given code.

Specified by:

getRecordTypeString in interface StreamInterface

getRecordTypeCode

public int getRecordTypeCode(java.lang.String name)

Description copied from interface: StreamInterface

Return the integer code associated with the user-defined record type string in this record stream.

The code returned for an unknown name depends on the state of the stream. In a stream connected for writing, a new code is returned which henceforth will refer to that string; in a stream which is unconnected or connected for reading, the error code -1 is returned, signifying that the code is not yet known (i.e., because the stream record that might identify the code has not yet been processed).

Specified by:

getRecordTypeCode in interface StreamInterface

getRecordSourceString

public java.lang.String getRecordSourceString(int id)

Description copied from interface: StreamInterface

Return the arbitrary-length String identifying the user-defined source (writer) ID associated with a given code in this record stream. These strings have meaning only to the user. Typically, in SSFNet they will be NHI addresses; in 'real' internet environments they may be DNS names or IP addresses, etc.

Specified by:

getRecordSourceString in interface StreamInterface

getRecordSourceCode

public int getRecordSourceCode(java.lang.String name)

Description copied from interface: StreamInterface

Return the integer code associated with the user-defined record source string in this record stream. The code returned for an unknown name depends on the state of the stream. In a stream connected for writing, a new code is returned which henceforth will refer to that string; in a stream which is unconnected or connected for reading, the error code -1 is returned, signifying that the code is not yet known (i.e., because the stream record that might identify the code has not yet been processed).

Specified by:

getRecordSourceCode in interface StreamInterface

receive

public int receive(int type_code,
                   int source_code,
                   double timestamp,
                   byte[] buf,
                   int offset,
                   int length)

operations after a record of netflow stream is met if the record is NOT a netflow record, this function should be overloaded.

Specified by:

receive in interface StreamInterface

addType

protected void addType(java.lang.String spec)
                throws streamException

The method that will be called when a record of "type" announcement is met in the inputStream.

Parameters:

spec - the string generated from the record.

streamException

addSource

protected void addSource(java.lang.String spec)
                  throws streamException

The method that will be called when a record of "source nhi" announcement is met in the inputStream.

Parameters:

spec - the string generated from the record.

streamException

main

public static void main(java.lang.String[] args)

usage: java FilterPlayer <filter config> <flow data file> <stream name>