NAME
SYNOPSIS
DESCRIPTION
ERRORS
EXAMPLES
ENVIRONMENT
SEE ALSO
NOTES
WARNINGS
DIAGNOSTICS
BUGS
RESTRICTIONS
AUTHOR

NAME

CAIDA::Traffic2::FileReader - Reader for Traffic2-style output files.

SYNOPSIS

    use CAIDA::Traffic2::FileReader;
    my $reader = new CAIDA::Traffic2::FileReader(\*STDIN);
    $reader->set_conversion_options({'as_finder' => $as_finder});
    $reader->set_desired_table_types("Tuple Table", "AS Matrix");
    while (my $interval = $reader->get_next_interval()) {
        # Do stuff with $interval
    }

DESCRIPTION

FileReader is a class that simplifies the reading of Traffic2-style output files. Traffic2-style is that which is output by crl_traffic2 (now named crl_flow). Its interface is simple; simply specify an input source, the table types to be returned to the user, and iterate over all the intervals.

FileReader has the following member functions:

new (FILE): Creates a new FileReader. FILE can be either an open filehandle or a file name, and all data is read from it.
set_desired_table_types (LIST): Sets the list of table types to be returned. This is used to determine which tables to read from the input and/or convert from other tables. Examples are 'src IP Table' or 'Port_Matrix' or 'Tuple Table'. (Underscores are automatically converted into spaces.) These must be properly spelled and capitalized, as they might be used to call of a table's member function. For example, if a user requests a 'src IP Table' from an input file that has only Tuple Tables, then make_src_IP_Table() will be called. If no tables are set, then all tables that exist in the input file will be returned.; crl_flow currently only outputs Tuple Tables, but depending on the runtime options, there might be two for one SubinterfaceInfo in a single Interval, a table of expired flows and a table of active flows. These can be requested individually as 'Tuple Table (expired)' or 'Tuple Table (active)', or as a special case, simply 'Tuple Table' will return all that are valid.
set_conversion_options (OPTIONS): Sets conversion options to be used for converting tables that require more than mere aggregation. For example, an ASFinder object is needed to do AS lookups, a NetGeoClient object is needed to do country lookups, etc. OPTIONS is a reference to a hash containing these options, which are passed directly into the Tables conversion functions. See Conversion functions in the Tables manpage for more information.
get_next_interval (PRELOAD)
get_next_interval (): Returns the next Interval object from the input filehandle. PRELOAD is a boolean which affects the reading behavior. If PRELOAD is true, then FileReader will read in the entire interval at once, otherwise it will only read when it needs more data to satisfy the user's next request. The preferred behavior is to not use PRELOAD; however, any application that runs in real-time and could fill up a pipe's buffer might want to use PRELOAD in order to avoid that problem. The tradeoff is a (possibly significant) increase of memory usage.; At the end of the filehandle, this function returns undef.
get_metadata (FIELD): Returns metadata related to the interval. FIELD is the name of the specific piece of metadata. Valid FIELD values are:

ERRORS

EXAMPLES

ENVIRONMENT

NOTES

crl_flow can output in several different formats than the 'Traffic2' format, which are readable by Interval objects, but cause possibly unexpected behavior. crl_flow allows multiple different expiration algorithms, which can cause the output of multiple entries with the same key. These separate entries will be added together when read by these classes. In addition, 'active' flows are currently ignored entirely.

For best results, use crl_flow -I.

If you have any ideas about how better to deal with this (creating different tables for active and expired flows, creating tables that accept multiple separate entries with the same key), please write us at coral-bugs@caida.org

WARNINGS

DIAGNOSTICS

BUGS

RESTRICTIONS

AUTHOR

Ryan Koga <rkoga@caida.org>