DSCP Chain

This module contains the DSCPChain flow analysis chain which can be used by PATHspider’s Observer for recording Differentiated Services [RFC2474] details.

class pathspider.chains.dscp.DSCPChain[source]

This flow analysis chain records details of the Differentiated Services Field in the IP header.

Field Name

Type

Meaning

dscp_mark_syn_fwd

int

The value of the Differentiated Services codepoint seen on a TCP SYN packet in the forward direction

dscp_mark_data_fwd

int

The value of the Differentiated Services codepoint seen on a non-TCP packet or a TCP packet with a payload in the forward direction

dscp_mark_syn_rev

int

The value of the Differentiated Services codepoint seen on a TCP SYN packet in the reverse direction

dscp_mark_data_rev

int

The value of the Differentiated Services codepoint seen on a non-TCP packet or a TCP packet with a payload in the reverse direction

ip4(rec, ip, rev)[source]

Records DSCP markings from an IPv4 header.

DSCP Marking

For the first TCP SYN packet and the first non-TCP packet or TCP packet with a payload, the DSCP value will be recorded in the relevant field.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip) – the IPv4 packet that was observed to be part of this flow

  • rev (bool) – True if the packet was in the reverse direction, False if in the forward direction

Returns

Always True

Return type

bool

ip6(rec, ip, rev)[source]

Records DSCP markings from an IPv6 header.

DSCP Marking

For the first TCP SYN packet and the first non-TCP packet or TCP packet with a payload, the DSCP value will be recorded in the relevant field.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip6) – the IPv6 packet that was observed to be part of this flow

  • rev (bool) – True if the packet was in the reverse direction, False if in the forward direction

Returns

Always True

Return type

bool

new_flow(rec, ip)[source]

For a new flow, all fields will be initialised to None.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record

Returns

Always True

Return type

bool