Linx.Netfilter.Log.Event (Linx v0.1.0)

A decoded NFLOG packet event.

Fields populated from NFULA_* attributes. All optional — the kernel only includes attributes it has data for, and the consumer's :copy_mode controls whether :payload is present.

:group — NFLOG group the event came from (filled by the listener, not the kernel).
:prefix — string label from the rule's Expr.log(prefix: ...). nil if the rule didn't set one.
:hook — NF_INET_* hook number where the packet was captured.
:hw_protocol — Ethernet protocol (0x0800 = IPv4, 0x86dd = IPv6, etc.).
:mark — packet mark, if meta mark was set on the path.
:timestamp — {seconds, microseconds} since the epoch.
:indev / :outdev — interface ifindex of arrival / departure.
:physindev / :physoutdev — for bridged packets.
:hwaddr — source link-layer address (bytes).
:payload — packet bytes from the network header down (or nil if :copy_mode was :meta/:none).
:uid / :gid — owner of the originating local socket, if any (only meaningful for OUTPUT-hook captures).
:seq / :seq_global — sequence numbers if :seq / :seq_global flag was set on the listener.

Summary

Types

t()

Functions

decode(body)

Decodes a NFULNL_MSG_PACKET body into a %Log.Event{}.

Types

t()

@type t() :: %Linx.Netfilter.Log.Event{
  gid: non_neg_integer() | nil,
  group: 1..65535 | nil,
  hook: 0..255 | nil,
  hw_protocol: 0..65535 | nil,
  hwaddr: binary() | nil,
  indev: non_neg_integer() | nil,
  mark: non_neg_integer() | nil,
  outdev: non_neg_integer() | nil,
  payload: binary() | nil,
  physindev: non_neg_integer() | nil,
  physoutdev: non_neg_integer() | nil,
  prefix: String.t() | nil,
  seq: non_neg_integer() | nil,
  seq_global: non_neg_integer() | nil,
  timestamp: {non_neg_integer(), non_neg_integer()} | nil,
  uid: non_neg_integer() | nil
}

Functions

decode(body)

@spec decode(binary()) :: t()

Decodes a NFULNL_MSG_PACKET body into a %Log.Event{}.