[Oisf-devel] accessing flowints and flowbits in decode

[David Mandelberg]

On Thu, 2013-02-28 at 11:53 +0100, Victor Julien wrote:
> On 02/27/2013 10:29 PM, David Mandelberg wrote:
> > determine if the packet is part of a flow and access per-flow integers
> > and bits if it is? Is there a way to get the packet arrival time that
> > works for both live capture and reading pcap files? Is there any reason
> > not to format the packet arrival time as a *nix time and store it in a
> > flowint?
> 
> I think creating a detection keyword would be best. There you have
> access to the flow. You can use flowvars/flowints and such. From there
> you also have full access to the pkt headers, the raw pkt data, pkt time
> stamps, etc.

Thanks, that makes sense. I just started implementing it as a keyword
called flowtype that for now will just support values of "interactive"
or "!interactive", but hopefully it can be extended in the future for
other interesting properties of flows.