SSF.OS.NetFlow.Filter
Class FilterPlayer

java.lang.Object
  |
  +--SSF.OS.NetFlow.Filter.FilterPlayer
All Implemented Interfaces:
StreamInterface
Direct Known Subclasses:
Analyzer, NHIDemuxer

public class FilterPlayer
extends java.lang.Object
implements StreamInterface

It reads records from the net flow data file, pass all the records through a filter. It's NOT an extension of SSF.Util.Streams.BasicPlayer, but it might be in the future release.


Field Summary
protected  Filter filter
          filter is not from BasicPlayer
protected  java.util.Hashtable sourceDictionary
          in BasicPlayer, it's private member
protected  java.lang.String streamID
           
protected  java.util.Hashtable typeDictionary
          in BasicPlayer, it's private member
 
Constructor Summary
FilterPlayer(java.lang.String streamID)
           
 
Method Summary
protected  void addSource(java.lang.String spec)
          The method that will be called when a record of "source nhi" announcement is met in the inputStream.
protected  void addType(java.lang.String spec)
          The method that will be called when a record of "type" announcement is met in the inputStream.
 void assignFilter(Filter pFilter)
           
 void connectRead(java.lang.String url)
          Connect this stream to a data source at the given URL.
 void connectWrite(java.lang.String url)
          Connect this stream to a data sink at the given URL.
 void disconnect()
          Signal that no more records are to be received (if reading) or sent (if writing).
 int getRecordSourceCode(java.lang.String name)
          Return the integer code associated with the user-defined record source string in this record stream.
 java.lang.String getRecordSourceString(int id)
          Return the arbitrary-length String identifying the user-defined source (writer) ID associated with a given code in this record stream.
 int getRecordTypeCode(java.lang.String name)
          Return the integer code associated with the user-defined record type string in this record stream.
 java.lang.String getRecordTypeString(int id)
          Return the arbitrary-length String identifying the user-defined record type associated with a given code in this record stream.
 boolean isConnected()
          Return true if this stream has been successfully connected to a data source or sink, and not disconnected.
static void main(java.lang.String[] args)
          usage: java FilterPlayer <filter config> <flow data file> <stream name>
 int receive(int type_code, int source_code, double timestamp, byte[] buf, int offset, int length)
          operations after a record of netflow stream is met if the record is NOT a netflow record, this function should be overloaded.
 int send(int type_code, int source_code, double timestamp)
          Return the same value (zero for success, nonzero for failure) that would be returned by a send with the given header information and actual payload data, assuming no IOExceptions etc.
 int send(int type_code, int source_code, double timestamp, byte[] bytes, int offset, int length)
          Send a single record on the data stream.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

filter

protected Filter filter
filter is not from BasicPlayer


streamID

protected java.lang.String streamID

sourceDictionary

protected java.util.Hashtable sourceDictionary
in BasicPlayer, it's private member


typeDictionary

protected java.util.Hashtable typeDictionary
in BasicPlayer, it's private member

Constructor Detail

FilterPlayer

public FilterPlayer(java.lang.String streamID)
Method Detail

assignFilter

public void assignFilter(Filter pFilter)

connectWrite

public void connectWrite(java.lang.String url)
                  throws streamException
Description copied from interface: StreamInterface
Connect this stream to a data sink at the given URL. Then call send() several times to inject records into the stream. Call disconnect() to signal that no more records will be written.

Specified by:
connectWrite in interface StreamInterface
streamException

disconnect

public void disconnect()
Description copied from interface: StreamInterface
Signal that no more records are to be received (if reading) or sent (if writing). A stream may automatically disconnect under certain conditions.

Specified by:
disconnect in interface StreamInterface

connectRead

public void connectRead(java.lang.String url)
                 throws streamException
Description copied from interface: StreamInterface
Connect this stream to a data source at the given URL. Your receive() method will be called back each time a record is received. Call disconnect() to signal that you wish to receive no more records.

Specified by:
connectRead in interface StreamInterface
streamException

send

public int send(int type_code,
                int source_code,
                double timestamp,
                byte[] bytes,
                int offset,
                int length)
Description copied from interface: StreamInterface
Send a single record on the data stream. The type_code and source_code identify the record type and source (writer) uniquely. Obtain their values by calling lookupRecordTypeCode and lookupRecordSourceCode, respectively.

These codes are not portable across implementations, or even across runs within the same implementation; they are used for efficiency purposes to minimize the overhead associated with constructing, sending, receiving, and interpreting Strings. Returns zero if a record was sent, nonzero if no record was sent (due to error, suppression due to filtering, or any other cause).

Specified by:
send in interface StreamInterface

send

public int send(int type_code,
                int source_code,
                double timestamp)
Description copied from interface: StreamInterface
Return the same value (zero for success, nonzero for failure) that would be returned by a send with the given header information and actual payload data, assuming no IOExceptions etc.

Many source-side filtering schemes will suppress sends of records that match given profiles for record types, points of origin, or intervals of time. This standard inquiry method allows a savvy sender to avoid the overhead of preparing a bufferful of bytes that will simply be ignored anyway. First test the waters with a no-payload send(), and if it returns success (zero), prepare the bytes and call the full version of send().

Specified by:
send in interface StreamInterface

isConnected

public boolean isConnected()
Description copied from interface: StreamInterface
Return true if this stream has been successfully connected to a data source or sink, and not disconnected.

Specified by:
isConnected in interface StreamInterface

getRecordTypeString

public java.lang.String getRecordTypeString(int id)
Description copied from interface: StreamInterface
Return the arbitrary-length String identifying the user-defined record type associated with a given code in this record stream. Returns null if no String has been associated with the given code.

Specified by:
getRecordTypeString in interface StreamInterface

getRecordTypeCode

public int getRecordTypeCode(java.lang.String name)
Description copied from interface: StreamInterface
Return the integer code associated with the user-defined record type string in this record stream.

The code returned for an unknown name depends on the state of the stream. In a stream connected for writing, a new code is returned which henceforth will refer to that string; in a stream which is unconnected or connected for reading, the error code -1 is returned, signifying that the code is not yet known (i.e., because the stream record that might identify the code has not yet been processed).

Specified by:
getRecordTypeCode in interface StreamInterface

getRecordSourceString

public java.lang.String getRecordSourceString(int id)
Description copied from interface: StreamInterface
Return the arbitrary-length String identifying the user-defined source (writer) ID associated with a given code in this record stream. These strings have meaning only to the user. Typically, in SSFNet they will be NHI addresses; in 'real' internet environments they may be DNS names or IP addresses, etc.

Specified by:
getRecordSourceString in interface StreamInterface

getRecordSourceCode

public int getRecordSourceCode(java.lang.String name)
Description copied from interface: StreamInterface
Return the integer code associated with the user-defined record source string in this record stream. The code returned for an unknown name depends on the state of the stream. In a stream connected for writing, a new code is returned which henceforth will refer to that string; in a stream which is unconnected or connected for reading, the error code -1 is returned, signifying that the code is not yet known (i.e., because the stream record that might identify the code has not yet been processed).

Specified by:
getRecordSourceCode in interface StreamInterface

receive

public int receive(int type_code,
                   int source_code,
                   double timestamp,
                   byte[] buf,
                   int offset,
                   int length)
operations after a record of netflow stream is met if the record is NOT a netflow record, this function should be overloaded.

Specified by:
receive in interface StreamInterface

addType

protected void addType(java.lang.String spec)
                throws streamException
The method that will be called when a record of "type" announcement is met in the inputStream.

Parameters:
spec - the string generated from the record.
streamException

addSource

protected void addSource(java.lang.String spec)
                  throws streamException
The method that will be called when a record of "source nhi" announcement is met in the inputStream.

Parameters:
spec - the string generated from the record.
streamException

main

public static void main(java.lang.String[] args)
usage: java FilterPlayer <filter config> <flow data file> <stream name>