vanken 0.1.0 → 0.2.0

data/lib/vanken/core/coloring.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "yaml"
+require "tempfile"
+require "fileutils"
+require_relative "display_filter/compiler"
+
+module Vanken
+  module Core
+    module Coloring
+      Rule = Data.define(
+        :name, #: String
+        :filter, #: String
+        :light, #: Hash[String, String]
+        :dark, #: Hash[String, String]
+        :enabled, #: bool
+        :program #: DisplayFilter::Program
+      )
+
+      class RuleSet
+        DEFAULT_PATH = File.expand_path("../../../data/coloring_rules.yml", __dir__)
+        attr_reader :rules #: Array[Rule]
+
+        # @rbs (Hash[String, untyped] payload, ?catalog: untyped) -> void
+        def initialize(payload, catalog: nil)
+          raise Vanken::ConfigError, "unsupported coloring rules schema" unless payload.is_a?(Hash) && payload["schema_version"] == 1 && payload["rules"].is_a?(Array) && payload["rules"].size <= 256
+          @rules = payload.fetch("rules").map do |value|
+            raise Vanken::ConfigError, "invalid coloring rule" unless value.is_a?(Hash) && value["name"].is_a?(String) && value["filter"].is_a?(String) && !value["filter"].empty? && [true, false].include?(value["enabled"])
+            palettes = %w[light dark].map do |theme|
+              colors = value[theme]
+              raise Vanken::ConfigError, "invalid rule colors" unless colors.is_a?(Hash) && %w[fg bg].all? { |key| colors[key].is_a?(String) && /\A#[\da-fA-F]{6}\z/.match?(colors[key]) }
+              colors.slice("fg", "bg").transform_values { |color| color.dup.freeze }.freeze
+            end
+            Rule.new(value["name"].dup.freeze, value["filter"].dup.freeze, palettes[0], palettes[1], value["enabled"], DisplayFilter.compile(value["filter"], catalog: catalog))
+          end.freeze
+        rescue DisplayFilter::SyntaxError => error
+          raise Vanken::ConfigError, "invalid coloring filter: #{error.message}"
+        end
+
+        # @rbs (_FilterView view, ?theme: Symbol) -> Hash[Symbol, String]?
+        def match(view, theme: :light)
+          rule = @rules.find { |item| item.enabled && item.program.match?(view) }
+          return nil unless rule
+          palette = theme == :light ? rule.light : rule.dark
+          colors = {foreground: palette.fetch("fg")}
+          colors[:background] = palette.fetch("bg") unless theme == :high_contrast
+          colors
+        end
+
+        # @rbs () -> Hash[String, untyped]
+        def to_h
+          {"schema_version" => 1, "rules" => @rules.map do |rule|
+            {"name" => rule.name, "filter" => rule.filter, "light" => rule.light.dup, "dark" => rule.dark.dup, "enabled" => rule.enabled}
+          end}
+        end
+
+        # @rbs (String path) -> void
+        def save(path)
+          directory = File.dirname(File.expand_path(path))
+          FileUtils.mkdir_p(directory, mode: 0o700)
+          temporary = Tempfile.create(["coloring-", ".tmp"], directory)
+          temporary.write(YAML.dump(to_h))
+          temporary.flush
+          temporary.fsync
+          temporary.close
+          File.rename(temporary.path, path)
+        ensure
+          temporary&.close unless temporary&.closed?
+          File.unlink(temporary.path) if temporary && File.exist?(temporary.path)
+        end
+
+        # @rbs (String path, ?catalog: untyped) -> RuleSet
+        def self.load(path, catalog: nil)
+          raise Vanken::ConfigError, "coloring rules file exceeds 1 MiB" if File.size(path) > 1 << 20
+          new(YAML.safe_load(File.read(path), permitted_classes: [], aliases: false), catalog: catalog)
+        rescue Psych::Exception, SystemCallError => error
+          raise Vanken::ConfigError, error.message
+        end
+
+        # @rbs (?catalog: untyped) -> RuleSet
+        def self.defaults(catalog: nil) = load(DEFAULT_PATH, catalog: catalog)
+      end
+    end
+  end
+end

data/lib/vanken/core/frame_store.rb

@@ -114,8 +114,8 @@ module Vanken
             [@data, @records, @reader, @index_reader].compact.each(&:close)
             @closed = true
           end
+          FileUtils.remove_entry_secure(@directory) if remove && File.directory?(@directory)
         end
-        FileUtils.remove_entry_secure(@directory) if remove && File.directory?(@directory)
       end
 
       private
@@ -130,7 +130,7 @@ module Vanken
 
       def validate_directory
         raise Vanken::FileError, "unsafe session directory" unless File.directory?(@directory) && !File.symlink?(@directory) && File.stat(@directory).uid == Process.uid
-        %w[frames.idx frames.bin interfaces.json session.json].each do |name|
+        Dir.children(@directory).each do |name|
           path = File.join(@directory, name)
           next unless File.exist?(path) || File.symlink?(path)
           stat = File.lstat(path)

data/lib/vanken/core/stores.rb

@@ -116,12 +116,14 @@ module Vanken
       SIZE = 32
       attr_reader :streams #: Hash[Integer, Array[Integer]]
       attr_reader :experts #: Hash[Integer, Array[Hash[Symbol, untyped]]]
+      attr_reader :expert_count, :expert_max #: Integer
       # @rbs! @extra: Hash[Integer, Hash[String, untyped]]
       # @rbs! @io: File?
       # @rbs (String directory, ?persist: bool) -> void
       def initialize(directory, persist: true)
         @data = +"".b
         @extra, @streams, @experts = {}, Hash.new { |hash, key| hash[key] = [] }, {}
+        @expert_count = @expert_max = 0
         @io = File.open(File.join(directory, "annotations.bin"), "wb", 0o600) if persist
       end
       # @rbs (Integer number, annotation_values annotation) -> void
@@ -132,6 +134,8 @@ module Vanken
         @io&.write(record)
         @streams[annotation[:tcp_stream]] << number if annotation[:tcp_stream] >= 0
         @experts[number] = annotation[:expert_items] unless annotation[:expert_items].empty?
+        @expert_count += annotation[:expert_items].size
+        @expert_max = [@expert_max, annotation[:expert_max]].max
         @extra[number] = annotation[:extra] unless annotation[:extra].empty?
       end
       # @rbs () -> Hash[Symbol, untyped]
@@ -139,6 +143,7 @@ module Vanken
         batch = {data: @data, extras: @extra, streams: @streams.transform_values { |numbers| numbers }, experts: @experts}
         @data = +"".b
         @extra, @streams, @experts = {}, Hash.new { |hash, key| hash[key] = [] }, {}
+        @expert_count = @expert_max = 0
         batch
       end
       # @rbs (Hash[Symbol, untyped] batch) -> void
@@ -148,6 +153,13 @@ module Vanken
         @data << batch[:data]
         @extra.merge!(batch[:extras])
         @experts.merge!(batch[:experts])
+        batch[:experts].each_value do |items|
+          @expert_count += items.size
+          items.each do |item|
+            rank = {"note" => 1, "warn" => 2, "warning" => 2, "error" => 3}.fetch(item[:severity].to_s, 0)
+            @expert_max = [@expert_max, rank].max
+          end
+        end
         batch[:streams].each { |stream, numbers| @streams[stream].concat(numbers) }
       end
       # @rbs (Integer number) -> annotation_values

data/lib/vanken/gateway/detail_builder.rb

@@ -12,7 +12,7 @@ module Vanken
         frame = node("frame", "Frame #{raw.number}: #{raw.original_length} bytes on wire, #{raw.caplen} captured", offset: 0, length: raw.caplen)
         nodes = packet.layers.each_with_index.map do |layer, index|
           prefix = packet.layers.count { |item| item.protocol == layer.protocol } > 1 ? "#{layer.protocol}[#{index}]" : layer.protocol.to_s
-          klass = Redhound::Registry.default.protocols[layer.protocol]
+          klass = packet.registry.protocols[layer.protocol]
           source = packet.layer_source(layer)
           children = layer.fields.map do |field|
             value = field.value

data/lib/vanken/gateway/display_capture_filter.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require_relative "capture_filter"
+require_relative "../core/display_filter/parser"
+
+module Vanken
+  module Gateway
+    class DisplayCaptureFilter
+      Packet = Struct.new(:data, :original_length, :linktype, :meta)
+      TUNNEL_PORTS = [4789, 8472, 6081].freeze
+      attr_reader :expression
+
+      def initialize(expression)
+        @expression = convert(Core::DisplayFilter::Parser.new(expression).parse)
+        @program = CaptureFilter.compile(@expression) if @expression
+      rescue CaptureFilter::Error
+        @expression = @program = nil
+      end
+
+      # nil requests the ordinary VDF evaluator; false is a definite non-match.
+      def match(frame)
+        return nil unless @program && eligible?(frame)
+        @program.match?(Packet.new(frame.bytes, frame.original_length, frame.linktype, {}))
+      end
+
+      private
+
+      def convert(node)
+        case node.kind
+        when :and, :or
+          left, right = convert(node.left), convert(node.right)
+          "(#{left}) #{node.kind} (#{right})" if left && right
+        when :not
+          child = convert(node.left)
+          "not (#{child})" if child
+        when :test
+          field, predicate = node.left.value, node.right
+          return {"ip" => "ip", "ipv6" => "ip6", "tcp" => "tcp", "udp" => "udp"}[field] unless predicate
+          return nil unless %i[eq ne in].include?(predicate.operator)
+          members = predicate.values.map { |member| term(field, member) }
+          return nil if members.any?(&:nil?) || members.empty?
+          result = members.map { |member| "(#{member})" }.join(" or ")
+          predicate.operator == :ne ? "not (#{result})" : result
+        end
+      end
+
+      def term(field, member)
+        token = member.first
+        if (port = /\A(tcp|udp)\.(port|srcport|dstport)\z/.match(field))
+          return nil unless token.type == :integer && token.value.between?(0, 65_535)
+          direction = {"srcport" => "src ", "dstport" => "dst "}.fetch(port[2], "")
+          if member.last
+            last = member.last
+            return nil unless last.type == :integer && last.value.between?(token.value, 65_535)
+            "#{port[1]} #{direction}portrange #{token.value}-#{last.value}"
+          else
+            "#{port[1]} #{direction}port #{token.value}"
+          end
+        elsif (address = /\A(ip|ipv6)\.(addr|src|dst)\z/.match(field))
+          return nil unless token.type == :address && !member.last
+          value = IPAddr.new(token.value)
+          return nil unless value.ipv4? == (address[1] == "ip")
+          direction = {"src" => "src ", "dst" => "dst "}.fetch(address[2], "")
+          prefix = token.value.split("/", 2)[1]
+          literal = prefix ? "net #{value}/#{prefix}" : "host #{value}"
+          "#{address[1] == 'ip' ? 'ip' : 'ip6'} #{direction}#{literal}"
+        end
+      end
+
+      def eligible?(frame)
+        bytes = frame.bytes
+        return false unless frame.linktype == 1 && frame.original_length == bytes.bytesize && bytes.bytesize >= 34
+        type = bytes.unpack1("n", offset: 12)
+        if type == 0x0800
+          return false unless bytes.getbyte(14) == 0x45 && (bytes.unpack1("n", offset: 20) & 0x3fff).zero?
+          length = bytes.unpack1("n", offset: 16)
+          return false unless length >= 20 && length + 14 <= bytes.bytesize
+          transport, finish, protocol = 34, length + 14, bytes.getbyte(23)
+        elsif type == 0x86dd
+          return false unless bytes.bytesize >= 54 && bytes.getbyte(14) >> 4 == 6
+          length = bytes.unpack1("n", offset: 18)
+          return false unless length.positive? && length + 54 <= bytes.bytesize
+          transport, finish, protocol = 54, length + 54, bytes.getbyte(20)
+        else
+          return false
+        end
+        if protocol == 6
+          return false unless finish - transport >= 20
+          header = (bytes.getbyte(transport + 12) >> 4) * 4
+          header >= 20 && transport + header <= finish
+        elsif protocol == 17
+          return false unless finish - transport >= 8
+          ports = bytes.unpack("n2", offset: transport)
+          length = bytes.unpack1("n", offset: transport + 4)
+          (ports & TUNNEL_PORTS).empty? && length >= 8 && transport + length <= finish
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/lib/vanken/gateway/dissector.rb

@@ -15,12 +15,36 @@ module Vanken
       def self.rank(value) = {nil => 0, note: 1, warning: 2, warn: 2, error: 3}.fetch(value, 0)
     end
 
+    # The public plugin DSL registers through Registry.default; keep that lookup local.
+    module RegistryScope
+      module Default
+        # @rbs () -> Redhound::Registry
+        def default = Thread.current[:vanken_registry] || super
+      end
+
+      # @rbs [T] (Redhound::Registry registry) { () -> T } -> T
+      def self.with(registry)
+        previous = Thread.current[:vanken_registry]
+        Thread.current[:vanken_registry] = registry
+        yield
+      ensure
+        Thread.current[:vanken_registry] = previous
+      end
+    end
+    Redhound::Registry.singleton_class.prepend(RegistryScope::Default)
+
     class Dissector
       attr_reader :registry #: Redhound::Registry
       # @rbs (?verify_checksums: bool, ?decode_as: Array[String], ?plugins: Array[String]) -> void
       def initialize(verify_checksums: false, decode_as: [], plugins: [])
-        plugins.each { |path| load File.expand_path(path) }
         @registry = Redhound::Registry.default.copy
+        RegistryScope.with(@registry) do
+          plugins.each do |path|
+            load File.expand_path(path), true
+          rescue LoadError, SyntaxError => error
+            raise Vanken::ConfigError, "failed to load plugin #{path}: #{error.message}"
+          end
+        end
         decode_as.each { |rule| @registry.decode_as(rule) }
         @engine = Redhound::Engine.new(registry: @registry, verify_checksums: verify_checksums)
       end
@@ -45,6 +69,7 @@ module Vanken
 
     class PacketView
       attr_reader :raw_packet #: Redhound::Packet
+      attr_reader :registry #: Redhound::Registry
       # @rbs (Redhound::Packet packet, Redhound::Registry registry) -> void
       def initialize(packet, registry) = (@raw_packet = packet; @registry = registry)
       # @rbs (String name) -> Array[untyped]
@@ -86,7 +111,7 @@ module Vanken
       end
       # @rbs () -> String
       def info
-        safe_text(@raw_packet.summary)
+        RegistryScope.with(@registry) { safe_text(@raw_packet.summary) }
       end
       # @rbs () -> Core::annotation_values
       def annotations
@@ -132,12 +157,12 @@ module Vanken
     end
 
     class FieldCatalog
-      # @rbs () -> void
-      def initialize
+      # @rbs (?registry: Redhound::Registry) -> void
+      def initialize(registry: Redhound::Registry.default)
         @mutex = Mutex.new
         @fields = {} #: Hash[String, Hash[Symbol, untyped]]
-        @protocols = Redhound::Registry.default.protocols.keys.map { |id| id == :ipv4 ? "ip" : id.to_s }
-        Redhound::Registry.default.protocols.each do |id, klass|
+        @protocols = registry.protocols.keys.map { |id| id == :ipv4 ? "ip" : id.to_s }
+        registry.protocols.each do |id, klass|
           definitions = Array(klass.compiled_header&.definitions) #: Array[Redhound::FieldDefinition]
           definitions.each do |field|
             @fields[field.name] = {type: field.type, source: :dissect, protocol: id.to_s}.freeze

data/lib/vanken/gateway/exporter.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "csv"
+require "tempfile"
+require_relative "file_writer"
+require_relative "detail_builder"
+
+module Vanken
+  module Gateway
+    class Exporter
+      DEFAULT_COLUMNS = %i[number time source destination protocol length info].map { |key| {key: key, label: key.to_s.capitalize} }.freeze
+
+      def initialize(document) = (@document = document)
+
+      def numbers(scope: :all, range: "", selected: nil, exclude_ignored: false)
+        limit = @document.count
+        empty = [] #: Array[Integer]
+        values = case scope.to_sym
+        when :all then (1..limit).to_a
+        when :displayed then @document.display_numbers
+        when :selected then selected ? [selected] : empty
+        when :marked then @document.marked.to_a
+        when :between_marks
+          marks = @document.marked.to_a.sort
+          marks.empty? ? empty : (marks.first..marks.last).to_a
+        when :range then ranges(range, limit)
+        else raise ArgumentError, "invalid packet scope"
+        end
+        raise ArgumentError, "invalid packet number" unless values.all? { |number| number.is_a?(Integer) && number.between?(1, limit) }
+        values = values.reject { |number| @document.ignored.include?(number) } if exclude_ignored
+        values.sort.uniq
+      end
+
+      def write(path, format:, numbers: nil, columns: DEFAULT_COLUMNS, cancelled: nil)
+        format = format.to_sym
+        raise ArgumentError, "invalid export format" unless %i[pcap pcapng json ndjson text csv].include?(format)
+        numbers = (numbers || self.numbers).to_a.sort.uniq
+        raise IndexError, "invalid packet number" unless numbers.all? { |number| number.is_a?(Integer) && number.between?(1, @document.count) }
+        file = Tempfile.create([".vanken-export-", ".tmp"], File.dirname(File.expand_path(path)))
+        begin
+          file.binmode
+          case format
+          when :pcap, :pcapng
+            linktype = numbers.empty? ? 1 : @document.store.metadata(numbers.first)[:linktype]
+            FileWriter.open(file, format: format, linktype: linktype) do |writer|
+              numbers.each { |number| check_cancelled(cancelled); writer << @document.store.read(number) }
+            end
+          when :json, :ndjson then json(file, numbers, format, cancelled)
+          when :text
+            numbers.each do |number|
+              check_cancelled(cancelled)
+              @document.details(number).each { |node| text_node(file, node, 0) }
+              file.write("\n")
+            end
+          when :csv
+            csv = CSV.new(file)
+            visible = columns.reject { |column| column[:visible] == false }
+            csv << visible.map { |column| column[:label] || column[:key].to_s }
+            numbers.each { |number| check_cancelled(cancelled); csv << visible.map { |column| csv_value(number, column) } }
+          end
+          file.flush
+          file.fsync
+          file.close
+          File.rename(file.path, File.expand_path(path))
+        ensure
+          file.close unless file.closed?
+          FileUtils.rm_f(file.path)
+        end
+        path
+      end
+
+      private
+
+      def ranges(value, limit)
+        raise ArgumentError, "packet range is empty" if value.strip.empty?
+        value.split(",", -1).flat_map do |part|
+          match = /\A\s*(\d+)(?:\s*-\s*(\d*))?\s*\z/.match(part)
+          raise ArgumentError, "invalid packet range: #{part}" unless match
+          first = match[1].to_i
+          last = match[2].nil? ? first : match[2].empty? ? limit : match[2].to_i
+          raise ArgumentError, "packet range is outside capture" unless first.between?(1, limit) && last.between?(first, limit)
+          (first..last).to_a
+        end
+      end
+
+      def check_cancelled(cancelled)
+        raise Vanken::Error, "operation cancelled" if cancelled&.call || @document.closing?
+      end
+
+      def json(file, numbers, format, cancelled)
+        dissector = Dissector.new(**@document.analysis_gateway_options)
+        analysis = Analysis.new(registry: dissector.registry, **@document.analysis_options)
+        selected = numbers.to_set
+        written = false
+        file.write("[") if format == :json
+        # Replay preceding packets so stateful fields and reassembled layers match the document.
+        (1..(numbers.last || 0)).each do |number|
+          check_cancelled(cancelled)
+          packet = dissector.dissect(@document.store.read(number))
+          analysis.update(packet)
+          next unless selected.include?(number)
+          file.write(",") if format == :json && written
+          file.write(JSON.generate(packet.to_h))
+          file.write("\n") if format == :ndjson
+          written = true
+        end
+        file.write("]\n") if format == :json
+      ensure
+        analysis&.close
+      end
+
+      def text_node(file, node, depth)
+        file.write("#{'  ' * depth}#{node.label}\n")
+        node.children.each { |child| text_node(file, child, depth + 1) }
+      end
+
+      def csv_value(number, column)
+        return @document.view(number).values(column[:field]).map(&:to_s).join(", ") if column[:field]
+        return @document.time_value(number, column[:format] || :relative) if column[:key].to_sym == :time
+        @document.row(number)[column[:key].to_sym]
+      end
+    end
+  end
+end

data/lib/vanken/gateway/file_writer.rb

@@ -22,12 +22,34 @@ module Vanken
       def initialize(output, format: :pcapng, **options)
         @format = format.to_sym
         @interfaces = {} #: Hash[Hash[String, untyped], Redhound::Capture::Interface]
-        if output.is_a?(String)
+        rotating = options[:max_bytes] || options[:interval]
+        if rotating
+          raise ArgumentError, "ring output must be a fixed file path" unless output.is_a?(String) && output != "-" && !output.include?("%")
+          count = options.fetch(:file_count, 10)
+          raise ArgumentError, "ring file count must be between 1 and 1000" unless count.is_a?(Integer) && count.between?(1, 1000)
+          %i[max_bytes interval].each do |key|
+            value = options[key]
+            raise ArgumentError, "#{key} must be positive" if value && (!value.is_a?(Numeric) || !value.finite? || !value.positive?)
+          end
+          options = options.merge(file_count: count)
+          # The public Writer cycles slots when max_bytes is present, also for time-based rings.
+          options[:max_bytes] ||= 9_223_372_036_854_775_807
+          extension = File.extname(output)
+          stem = output.delete_suffix(extension)
+          count.times do |index|
+            path = "#{stem}_#{format('%05d', index)}#{extension}"
+            next unless File.exist?(path) || File.symlink?(path)
+            File.open(path, File::RDWR | File::NOFOLLOW) do |file|
+              raise ArgumentError, "ring output must be a regular, unlinked file owned by this user" unless file.stat.file? && file.stat.nlink == 1 && file.stat.uid == Process.uid
+              file.chmod(0o600)
+            end
+          end
+        elsif output.is_a?(String)
           @owned = File.open(output, "wb", 0o600)
           @owned.chmod(0o600)
         end
         @writer = Redhound::Writer.open(@owned || output, format: @format, **options)
-      rescue Redhound::Error, IOError, SystemCallError => error
+      rescue Redhound::Error, ArgumentError, IOError, SystemCallError => error
         @owned&.close
         raise Vanken::FileError, error.message
       end
@@ -45,6 +67,8 @@ module Vanken
       end
       # @rbs () -> void
       def flush = @writer.flush
+      # @rbs () -> Integer
+      def bytes_written = @writer.bytes_written
       # @rbs (Redhound::Capture::Stats | Hash[Symbol | String, Integer] stats, ?interface: Redhound::Capture::Interface?) -> void
       def write_stats(stats, interface: nil)
         if stats.is_a?(Hash)

data/lib/vanken/gateway/interfaces.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "redhound"
+require "open3"
 
 module Vanken
   module Gateway
@@ -25,6 +26,64 @@ module Vanken
       def self.find(name)
         list.find { |interface| interface[:name] == name } || raise(NotFound, "interface #{name.inspect} not found")
       end
+
+      # @rbs () -> Hash[String, Integer]
+      def self.traffic_counters
+        if RUBY_PLATFORM.include?("linux")
+          parse_linux_counters(File.read("/proc/net/dev"))
+        elsif RUBY_PLATFORM.include?("darwin")
+          output, _, status = Open3.capture3("/usr/sbin/netstat", "-ibn")
+          status.success? ? parse_darwin_counters(output) : {}
+        else
+          {}
+        end
+      rescue SystemCallError, IOError
+        {}
+      end
+
+      # @rbs (String text) -> Hash[String, Integer]
+      def self.parse_linux_counters(text)
+        result = {} #: Hash[String, Integer]
+        text.each_line do |line|
+          name, fields = line.split(":", 2)
+          next unless name && fields
+          values = fields.split
+          next unless values.length >= 16 && values[0].match?(/\A\d+\z/) && values[8].match?(/\A\d+\z/)
+          result[name.strip] = values[0].to_i + values[8].to_i
+        end
+        result
+      end
+
+      # @rbs (String text) -> Hash[String, Integer]
+      def self.parse_darwin_counters(text)
+        lines = text.lines
+        header = lines.shift.to_s.split
+        first, received, sent = header.index("Ipkts"), header.index("Ibytes"), header.index("Obytes")
+        return {} unless first && received && sent
+        result = {} #: Hash[String, Integer]
+        lines.each do |line|
+          fields = line.split
+          next unless fields[2]&.start_with?("<Link#")
+          counters = fields.last(header.length - first)
+          incoming, outgoing = counters[received - first], counters[sent - first]
+          next unless incoming&.match?(/\A\d+\z/) && outgoing&.match?(/\A\d+\z/)
+          result[fields.first.delete_suffix("*")] = incoming.to_i + outgoing.to_i
+        end
+        result
+      end
+
+      # @rbs (?previous: Hash[Symbol, untyped]?, ?history: Hash[String, Array[Integer]], ?now: Integer | Float) -> Hash[Symbol, untyped]
+      def self.sample_traffic(previous: nil, history: {}, now: Process.clock_gettime(Process::CLOCK_MONOTONIC))
+        counters = traffic_counters
+        elapsed = previous ? now.to_f - previous[:time].to_f : 0.0
+        rates = counters.to_h do |name, bytes|
+          old = previous && previous[:counters][name]
+          rate = old && elapsed.positive? ? [(bytes - old).fdiv(elapsed), 0].max.to_i : 0
+          [name, rate]
+        end
+        samples = rates.to_h { |name, rate| [name, ((history[name] || []) + [rate]).last(60)] }
+        {previous: {time: now, counters: counters}, rates: rates, history: samples}
+      end
     end
   end
 end