DSCP Chain

This module contains the DSCPChain flow analysis chain which can be used by PATHspider’s Observer for recording Differentiated Services [RFC2474] details.

class pathspider.chains.dscp.DSCPChain[source]

This flow analysis chain records details of the Differentiated Services Field in the IP header.

Field Name Type Meaning
dscp_mark_syn_fwd int The value of the Differentiated Services codepoint seen on a TCP SYN packet in the forward direction
dscp_mark_data_fwd int The value of the Differentiated Services codepoint seen on a non-TCP packet or a TCP packet with a payload in the forward direction
dscp_mark_syn_rev int The value of the Differentiated Services codepoint seen on a TCP SYN packet in the reverse direction
dscp_mark_data_rev int The value of the Differentiated Services codepoint seen on a non-TCP packet or a TCP packet with a payload in the reverse direction
ip4(rec, ip, rev)[source]

Records DSCP markings from an IPv4 header.

DSCP Marking
For the first TCP SYN packet and the first non-TCP packet or TCP packet with a payload, the DSCP value will be recorded in the relevant field.
Parameters:
  • rec (dict) – the flow record
  • ip (plt.ip) – the IPv4 packet that was observed to be part of this flow
  • rev (bool) – True if the packet was in the reverse direction, False if in the forward direction
Returns:

Always True
Return type:

bool
ip6(rec, ip, rev)[source]

Records DSCP markings from an IPv6 header.

DSCP Marking
For the first TCP SYN packet and the first non-TCP packet or TCP packet with a payload, the DSCP value will be recorded in the relevant field.
Parameters:
  • rec (dict) – the flow record
  • ip (plt.ip6) – the IPv6 packet that was observed to be part of this flow
  • rev (bool) – True if the packet was in the reverse direction, False if in the forward direction
Returns:

Always True
Return type:

bool
new_flow(rec, ip)[source]

For a new flow, all fields will be initialised to None.

Parameters:
  • rec (dict) – the flow record
  • ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record
Returns:

Always True
Return type:

bool