public class DroolsKrakenProtocolHandler extends Object implements PcapActivityListener, Closeable
OutputWriterStrategy
.
It listens to all appropriate events creates by the protocol decoders and injects them into to Drools knowledge base
session (KieSession
).
Finally, it also reacts to Event removal events, which originate from the rule engine itself and are utilized
as indicator to write these events to the pre-defined output stream before they are discarded from memory.
It is vital to invoke the close()
method after usage of the rule engine, because otherwise the
remaining events and/or facts which are still in the active knowledge base will _not_ be written to the output stream
and this will lead to missing output.
This class will provide certain global objects that may be used from the Drools rule files, e.g.
a Logger
via "log" and the used OutputWriterStrategy
via "outputWriter".
Constructor and Description |
---|
DroolsKrakenProtocolHandler(RubanetraSystemConfiguration systemConfig)
Instantiates a new handler for a pre-initialized RubanetraSystemConfiguration
|
Modifier and Type | Method and Description |
---|---|
void |
close()
Closes the drools session and deletes, i.e.
|
void |
processPcapActivity(PcapActivity pcapActivity)
Do something useful with the Layer 1 packet capture metadata and the actually parsed content
|
public DroolsKrakenProtocolHandler(RubanetraSystemConfiguration systemConfig)
systemConfig
- the system configuration to use, may not be null and must be initializedpublic void processPcapActivity(PcapActivity pcapActivity)
PcapActivityListener
processPcapActivity
in interface PcapActivityListener
pcapActivity
- the wrapper of the JNetPcap specific PcapPacket
that was parsed
by a PcapHandler
.public void close() throws IOException
OutputWriterStrategy
and
the used KieSession
.close
in interface Closeable
close
in interface AutoCloseable
IOException
- if an I/O error occursCopyright © 2013–2015 Institute of networks and security. All rights reserved.