flowGenerator

Class FlowGenerator

java.lang.Object

flowGenerator.FlowGenerator

All Implemented Interfaces:

java.lang.Runnable

public class FlowGenerator
extends java.lang.Object
implements java.lang.Runnable

The class FlowGenerator is responsible for managing flows. Flow is defined as a group of packets having the same:
- local IP address
- remote IP address
- local transport layer port
- remote transport layer port
- transport layer protocol

Tasks done by this class include:
- grouping packets in flows
- associating flows with corresponding sockets
- closing flows if the corresponding socket is closed
- closing time-out flows

It is intended to run in its own thread.

Author:

Jacob Honoré Broberg, Kartheepan Balachandran (kba@es.aau.dk), Tomasz Bujlow (tbu@es.aau.dk)

Field Summary

Fields

Modifier and Type	Field and Description
private java.util.Hashtable<java.lang.Integer,SocketInfo>	availableSockets List of sockets, which are available to be matched to flows.
private static long	DEFAULT_TIMEOUT_THRESHOLD Default time-out for flows.
private java.lang.Thread	flowGeneratorThread Thread used by this class.
private java.util.LinkedHashSet<Flow>	flowTimeOutList List of flows, which will be closed based on time-out, instead of normal closing based on closed matching socket.
private boolean	isStarted Flag used to determine if the thread is fully started.
private static org.apache.log4j.Logger	log Used to log different events.
private CapturedPacketsQueue	myCapturedPacketsQueue Queue of captured packets.
private ClosedFlowsQueue	myClosedFlowsQueue Queue to store closed flows.
private SocketMonitorQueue	mySocketMonitorQueue Queue of information about opened or closed sockets.
private java.util.Hashtable<java.lang.Integer,Flow>	openFlowList List of open flows.
private boolean	runFlag Flag used to stop the thread.
private java.util.LinkedHashSet<SocketInfo>	socketsToClose List of sockets which needs to be closed.
private long	timeoutThreshold Time-out for flows.

Constructor Summary

Constructors

Constructor and Description
FlowGenerator(CapturedPacketsQueue myCapturedPacketsQueue, SocketMonitorQueue mySocketMonitorQueue) Constructs the object.

Method Summary

Methods

Modifier and Type	Method and Description
private void	closeAllFlows() Closes all flows.
private void	closeFlow(Flow currentFlow, long endTimeInUsec) Closes the flow.
private void	createNewFlow(CapturedPacket newCapturedPacket) Creates a new Flow and adds it to the openFlowList.
private void	flushTimeoutFlows() Closes all timed-out flows.
ClosedFlowsQueue	getClosedFlowsQueue() Gets queue of closed flows.
private void	handleClosedSockets() Processes information about closed sockets.
private void	handleOpenSockets() Processes information about newly opened sockets.
boolean	isAlive() Checks if FlowGenerator is alive.
void	run() Runs the thread in loop.
void	setTimeoutThreshold(long timeoutThresholdInMillis) Sets time after which a flow will be timed out.
void	start() Starts the thread.
void	stop() Stops the thread.
private void	updateFlow(CapturedPacket newCapturedPacket, Flow currentFlow) The currentFlow is updated with the newCapturedPacket.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

private static org.apache.log4j.Logger log

Used to log different events.

flowGeneratorThread

private java.lang.Thread flowGeneratorThread

Thread used by this class.

DEFAULT_TIMEOUT_THRESHOLD

private static final long DEFAULT_TIMEOUT_THRESHOLD

Default time-out for flows.

See Also:

Constant Field Values

timeoutThreshold

private long timeoutThreshold

Time-out for flows.

myCapturedPacketsQueue

private CapturedPacketsQueue myCapturedPacketsQueue

Queue of captured packets.

mySocketMonitorQueue

private SocketMonitorQueue mySocketMonitorQueue

Queue of information about opened or closed sockets.

openFlowList

private java.util.Hashtable<java.lang.Integer,Flow> openFlowList

List of open flows. Hashtable allows to index these flows by their id.

flowTimeOutList

private java.util.LinkedHashSet<Flow> flowTimeOutList

List of flows, which will be closed based on time-out, instead of normal closing based on closed matching socket.

availableSockets

private java.util.Hashtable<java.lang.Integer,SocketInfo> availableSockets

List of sockets, which are available to be matched to flows.

socketsToClose

private java.util.LinkedHashSet<SocketInfo> socketsToClose

List of sockets which needs to be closed.

runFlag

private boolean runFlag

Flag used to stop the thread.

isStarted

private boolean isStarted

Flag used to determine if the thread is fully started.

myClosedFlowsQueue

private ClosedFlowsQueue myClosedFlowsQueue

Queue to store closed flows.

Constructor Detail

FlowGenerator

public FlowGenerator(CapturedPacketsQueue myCapturedPacketsQueue,
             SocketMonitorQueue mySocketMonitorQueue)

Constructs the object.

Parameters:

myCapturedPacketsQueue - queue of captured packets

mySocketMonitorQueue - queue of socket information

Method Detail

start

public void start()

Starts the thread.

stop

public void stop()

Stops the thread.

isAlive

public boolean isAlive()

Checks if FlowGenerator is alive. It means that:
- the thread must exists
- the thread must be fully started and running (isStarted equals true). This condition is used to check if the thread is fully started or if it needs more time to start.

Returns:

true if the thread is fully started and operational, false otherwise

run

public void run()

Runs the thread in loop. The logic is following:
- try to take new packet from the queue
- if there is no packet in the queue, spend the time on closing flows which are timed out
- if a packet is received, assign it to an existing flow (if matching flow exists), otherwise create a new flow
- after servicing 999 packets make a break for closing flows which are timed out
- when the thread is going to finish, close all the existing flows

Specified by:

run in interface java.lang.Runnable

handleOpenSockets

private void handleOpenSockets()

Processes information about newly opened sockets.

handleClosedSockets

private void handleClosedSockets()

Processes information about closed sockets. When the socket is closed try to find all flows using the same transport layer protocol and using the same transport layer port, as it used by the socket. It does not mean that the flow match the socket (we do not check remote IP address and remote transport layer port). It only means that we know that we can assign to that flow the application name from the socket (only one application a time can use the same transport layer port on a machine). If a flow does not have assigned any application name, assign the application name from the socket.
- if the transport layer protocol associated with the socket is TCP, check if the socket is fully matched to the flow. If yes, close the flow. - if the transport layer protocol is UDP, the socket is always fully matched to the flow, so close the flow.
The general difference between TCP and UDP sockets is simple: for each TCP connection there is another TCP socket opened. All the sockets can have the same local IP address and local transport layer port, but they have different remote transport layer ports. For UDP, all transmissions having the same local IP address and the same transport layer port originate from the same socket. Remote parameters are marked by wildcards (*).

createNewFlow

private void createNewFlow(CapturedPacket newCapturedPacket)

Creates a new Flow and adds it to the openFlowList. UDP flows are always a subject to timeout, even if the matching socket is still open for other flows. TCP flows are a subject to timeout if they are not matched to an appropriate socket.
The general difference between TCP and UDP sockets is simple: for each TCP connection there is another TCP socket opened. All the sockets can have the same local IP address and local transport layer port, but they have different remote transport layer ports. For UDP, all transmissions having the same local IP address and the same transport layer port originate from the same socket. Remote parameters are marked by wildcards (*).

Parameters:

newCapturedPacket - the packet that caused the flow to be created, and is added to the Flow

updateFlow

private void updateFlow(CapturedPacket newCapturedPacket,
              Flow currentFlow)

The currentFlow is updated with the newCapturedPacket.

Parameters:

newCapturedPacket - packet that is added to the Flow

currentFlow - the Flow to be updated

flushTimeoutFlows

private void flushTimeoutFlows()

Closes all timed-out flows.

closeAllFlows

private void closeAllFlows()

Closes all flows. Used when the FlowGenerator is closed

setTimeoutThreshold

public void setTimeoutThreshold(long timeoutThresholdInMillis)

Sets time after which a flow will be timed out.

Parameters:

timeoutThresholdInMillis - the time measured in miliseconds

closeFlow

private void closeFlow(Flow currentFlow,
             long endTimeInUsec)

Closes the flow. Unidirectional flows are discarded, because they are the result of change of the IP address on an interface. This prevents from corrupting the database until the address change is detected and the VBS client is restarted.

Parameters:

currentFlow - flow which will be closed

endTimeInUsec - timestamp of closing the flow measured in microseconds

getClosedFlowsQueue

public ClosedFlowsQueue getClosedFlowsQueue()

Gets queue of closed flows.

Returns:

queue of closed flows