isc.sensor
Class TCPSessionProcessor

java.lang.Object
  java.lang.Thread
      isc.sensor.SessionProcessor
          isc.sensor.TCPSessionProcessor

All Implemented Interfaces:

java.lang.Runnable

Direct Known Subclasses:

AppLayerMgrTCP

public class TCPSessionProcessor
extends SessionProcessor

The TCP Session processor manage the full lifecycle for each tcp session, defined by a client/port server/port pair. The Session processor runs in its own Thread

Author:

John Casey
Project: DNA_sensor - Aug 12, 2005

TODO:

• Externalize SVNUM
• Process packet retransmissions
• Parent/child session definition
• Dynamic signature service definition

Nested Class Summary

Nested classes/interfaces inherited from class java.lang.Thread

java.lang.Thread.State, java.lang.Thread.UncaughtExceptionHandler

Field Summary

protected static org.apache.log4j.Logger	log log4j
protected static java.lang.String	PROP_DBSIZE Property to specify the initial size of the inflight packet flow hashtable
protected static java.lang.String	PROP_SESHASH_SIZE Property to specify the initial size of the active session hash table
protected static java.lang.String	PROP_SESSION_OUTPUT Property to enable/disable session output
protected static java.lang.String	PROP_WORKQ_SIZE Property to specify the initial size of the packet work queue
protected static java.lang.String[]	svcnams Array of well-know services
protected static int[]	svcnums Array of well-known service ports

Fields inherited from class isc.sensor.SessionProcessor

currentPacketTime, dbh, finish, packetDB, PROP_OUTPUTWRITERCLASS, props, sessions, sesTimer, sesWorkQueue, workItem, writeSession

Fields inherited from class java.lang.Thread

MAX_PRIORITY, MIN_PRIORITY, NORM_PRIORITY

Constructor Summary

TCPSessionProcessor()
Create a new TCP Session processor, internally controlled Thread

TCPSessionProcessor(boolean startThread)
Create a new TCP Session processor, stub for a subclass to manage the initialization of the thread

Method Summary

void	addPacket(TCPBean tcpbean) Add a packet to be process into a session
protected void	flush(SessionBean tcpsbean) Flush/write out a completed TCP Session
protected void	init(boolean startThread, boolean writeSession) Initialize this session processor from this class or a subclass.
void	insertBeanDB(TCPBean bean) Add a packet to the current session's packet summary DB
protected void	processWorkItem() Process the sesWorkQueue containing completed sessions @see SessionProcessor#addCompletedSession(String)

Methods inherited from class isc.sensor.SessionProcessor

addCompletedSession, close, finished, getActiveSessions, getSessionPackets, notifyProc, open, run, setFinish, updatePacketClock, waitProc

Methods inherited from class java.lang.Thread

activeCount, checkAccess, countStackFrames, currentThread, destroy, dumpStack, enumerate, getAllStackTraces, getContextClassLoader, getDefaultUncaughtExceptionHandler, getId, getName, getPriority, getStackTrace, getState, getThreadGroup, getUncaughtExceptionHandler, holdsLock, interrupt, interrupted, isAlive, isDaemon, isInterrupted, join, join, join, resume, setContextClassLoader, setDaemon, setDefaultUncaughtExceptionHandler, setName, setPriority, setUncaughtExceptionHandler, sleep, sleep, start, stop, stop, suspend, toString, yield

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

svcnums

protected static final int[] svcnums

Array of well-known service ports

svcnams

protected static final java.lang.String[] svcnams

Array of well-know services

PROP_SESSION_OUTPUT

protected static java.lang.String PROP_SESSION_OUTPUT

Property to enable/disable session output

PROP_WORKQ_SIZE

protected static java.lang.String PROP_WORKQ_SIZE

Property to specify the initial size of the packet work queue

PROP_SESHASH_SIZE

protected static java.lang.String PROP_SESHASH_SIZE

Property to specify the initial size of the active session hash table

PROP_DBSIZE

protected static java.lang.String PROP_DBSIZE

Property to specify the initial size of the inflight packet flow hashtable

log

protected static org.apache.log4j.Logger log

log4j

Constructor Detail

TCPSessionProcessor

public TCPSessionProcessor()

Create a new TCP Session processor, internally controlled Thread

TCPSessionProcessor

public TCPSessionProcessor(boolean startThread)

Create a new TCP Session processor, stub for a subclass to manage the initialization of the thread

Parameters:

startThread - unused

Method Detail

init

protected void init(boolean startThread,
                    boolean writeSession)

Initialize this session processor from this class or a subclass. External management of the writer flag and thread creation

Parameters:

startThread - True to start the thread internally, False to start/manage the thread from a subclass

writeSession - True to write out the session record, False to disable

insertBeanDB

public void insertBeanDB(TCPBean bean)

Add a packet to the current session's packet summary DB

Parameters:

bean - The TCPBean to add

processWorkItem

protected void processWorkItem()

Process the sesWorkQueue containing completed sessions @see SessionProcessor#addCompletedSession(String)

Overrides:

processWorkItem in class SessionProcessor

addPacket

public void addPacket(TCPBean tcpbean)

Add a packet to be process into a session

Parameters:

tcpbean - The TCPBean to be processed

flush

protected void flush(SessionBean tcpsbean)

Flush/write out a completed TCP Session

Parameters:

tcpsbean - The TCPSession bean to flush