vanken 0.1.0

data/lib/vanken/core/frame_view.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Vanken
+  module Core
+    class FrameView
+      # @rbs (App::Document document, Integer number, ?packet: Gateway::PacketView?, ?snapshot: Hash[Symbol, untyped]?) -> void
+      def initialize(document, number, packet: nil, snapshot: nil)
+        @document, @number, @packet = document, number, packet
+        @snapshot = snapshot
+        @metadata = nil #: frame_metadata?
+      end
+      # @rbs (String name) -> bool
+      def layer?(name) = @packet ? @packet.layer?(name) : !!@document.columns.layer?(@number, name)
+      # @rbs (String name) -> Symbol?
+      def field_type(name) = packet.field_type(name)
+      # @rbs (String name) -> Array[untyped]
+      def values(name)
+        case name
+        when "frame.number" then [@number]
+        when "frame.len" then [metadata[:original_length]]
+        when "frame.cap_len" then [metadata[:caplen]]
+        when "frame.time_epoch" then [metadata[:timestamp_ns] / 1e9]
+        when "frame.time_relative" then [@document.time_value(@number, :relative, references: @snapshot&.fetch(:references))]
+        when "frame.time_delta" then [@number == 1 ? 0.0 : (metadata[:timestamp_ns] - @document.store.metadata(@number - 1)[:timestamp_ns]) / 1e9]
+        when "frame.time_delta_displayed" then [displayed_delta]
+        when "frame.interface_name"
+          interface = metadata[:interface]
+          interface ? [interface["name"]] : []
+        when "frame.direction" then metadata[:direction] ? [metadata[:direction].to_s] : []
+        when "frame.marked" then [(@snapshot ? @snapshot[:marked] : @document.marked).include?(@number)]
+        when "frame.ignored" then [(@snapshot ? @snapshot[:ignored] : @document.ignored).include?(@number)]
+        when "frame.protocols" then [column[:layers].join(":")]
+        when "tcp.port", "udp.port", "tcp.srcport", "tcp.dstport", "udp.srcport", "udp.dstport"
+          @packet ? @packet.values(name) : @document.columns.port_values(@number, name)
+        when "tcp.stream" then annotation[:tcp_stream] >= 0 ? [annotation[:tcp_stream]] : []
+        when "tcp.seq_relative" then annotation[:seq_rel] >= 0 ? [annotation[:seq_rel]] : []
+        when "tcp.ack_relative" then annotation[:ack_rel] >= 0 ? [annotation[:ack_rel]] : []
+        when "tcp.analysis.flags" then annotation[:analysis_flags].empty? ? [] : [true]
+        when "expert.severity" then annotation[:expert_items].map { |item| item[:severity].to_s }
+        when "expert.code" then annotation[:expert_items].map { |item| item[:code] }
+        else
+          if name.start_with?("tcp.analysis.")
+            return [true] if annotation[:analysis_flags].include?(name.delete_prefix("tcp.analysis."))
+            return Array(annotation[:extra][name]).compact
+          end
+          packet.values(name)
+        end
+      end
+      private
+      # @rbs () -> frame_metadata
+      def metadata = @metadata ||= @document.store.metadata(@number)
+      # @rbs () -> column_values
+      def column = @column ||= @packet ? @packet.columns : @document.columns[@number]
+      # @rbs () -> annotation_values
+      def annotation = @annotation ||= @packet ? @packet.annotations : @document.annotations[@number]
+      # @rbs () -> Gateway::PacketView | Gateway::PacketSnapshot
+      def packet = @packet ||= @document.packet_snapshot(@number) || @document.packet(@number)
+      # @rbs () -> Float
+      def displayed_delta
+        return @document.time_value(@number, :delta_displayed) unless @snapshot
+
+        previous = @document.displayed_predecessor(@number, @snapshot)
+        previous > 0 ? (metadata[:timestamp_ns] - @document.store.metadata(previous)[:timestamp_ns]) / 1e9 : 0.0
+      end
+    end
+  end
+end

data/lib/vanken/core/stores.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "set"
+require "json"
+
+module Vanken
+  module Core
+    class InternTable
+      # @rbs! @values: Array[String]
+      # @rbs! @ids: Hash[String, Integer]
+      # @rbs () -> void
+      def initialize
+        @values = [] #: Array[String]
+        @ids = {} #: Hash[String, Integer]
+      end
+      # @rbs (String value) -> Integer
+      def intern(value) = @ids.fetch(value) { @ids[value] = @values.length; @values << value.freeze; @values.length - 1 }
+      # @rbs (Integer id) -> String
+      def [](id) = @values.fetch(id)
+      # @rbs () -> Integer
+      def size = @values.size
+      # @rbs (Integer index) -> Array[String]
+      def since(index) = @values.drop(index)
+    end
+
+    class ColumnStore
+      FORMAT = "L<L<L<l<l<l<Q<"
+      SIZE = 32
+      attr_reader :strings #: InternTable
+      # @rbs! @protocol_ids: Hash[String, Integer]
+      # @rbs! @protocol_names: Array[String]
+      # @rbs! @transport_values: Hash[Integer, Hash[String, Array[Integer]]]
+      # @rbs! @base: Integer
+      # @rbs! @string_cursor: Integer
+      # @rbs! @protocol_cursor: Integer
+      # @rbs () -> void
+      def initialize
+        @strings = InternTable.new
+        @data = +"".b
+        @protocol_ids = {} #: Hash[String, Integer]
+        @protocol_names = [] #: Array[String]
+        @transport_values = {} #: Hash[Integer, Hash[String, Array[Integer]]]
+        @base = @string_cursor = @protocol_cursor = 0
+      end
+      # @rbs (column_values values) -> void
+      def append(values)
+        mask = values[:layers].reduce(0) do |bits, name|
+          id = @protocol_ids.fetch(name) { @protocol_ids[name] = @protocol_names.length; @protocol_names << name; @protocol_names.length - 1 }
+          raise Vanken::Error, "too many protocols in compact index" if id >= 64
+          bits | (1 << id)
+        end
+        @data << [@strings.intern(values[:source]), @strings.intern(values[:destination]), @strings.intern(values[:protocol]),
+                  values[:src_port], values[:dst_port], values[:ip_proto], mask].pack(FORMAT)
+        @transport_values[@base + (@data.bytesize / SIZE)] = values[:transport_values] if values[:transport_values]
+      end
+      # Transfer a batch without retaining a second copy of every frame in the worker.
+      # @rbs () -> Hash[Symbol, untyped]
+      def drain
+        batch = {data: @data, strings: @strings.since(@string_cursor), protocols: @protocol_names.drop(@protocol_cursor), transport: @transport_values}
+        @base += @data.bytesize / SIZE
+        @string_cursor, @protocol_cursor = @strings.size, @protocol_names.size
+        @data, @transport_values = +"".b, {}
+        batch
+      end
+      # @rbs (Hash[Symbol, untyped] batch) -> void
+      def import(batch)
+        raise Vanken::Error, "invalid column batch" unless batch[:data].bytesize % SIZE == 0
+        batch[:strings].each { |value| @strings.intern(value) }
+        batch[:protocols].each do |name|
+          raise Vanken::Error, "invalid protocol dictionary" if @protocol_ids.key?(name) || @protocol_names.size >= 64
+          @protocol_ids[name] = @protocol_names.length
+          @protocol_names << name
+        end
+        @data << batch[:data]
+        @transport_values.merge!(batch[:transport])
+      end
+      # @rbs (Integer number) -> column_values
+      def [](number)
+        src, dst, proto, sport, dport, ipproto, mask = @data.byteslice((number - 1) * SIZE, SIZE).unpack(FORMAT)
+        {source: @strings[src], destination: @strings[dst], protocol: @strings[proto], src_port: sport, dst_port: dport, ip_proto: ipproto, layers: @protocol_names.select { |name| mask & (1 << @protocol_ids[name]) != 0 }}
+      end
+      # @rbs (Integer number, String name) -> bool?
+      def layer?(number, name)
+        id = @protocol_ids[name]
+        id && (@data.unpack1("Q<", offset: ((number - 1) * SIZE) + 24) & (1 << id)) != 0
+      end
+      # @rbs (Integer number, String name) -> Array[Integer]
+      def port_values(number, name)
+        if (all = @transport_values[number])
+          names = name.end_with?(".port") ? [name.sub(".port", ".srcport"), name.sub(".port", ".dstport")] : [name]
+          return names.flat_map { |field| Array(all[field]) }
+        end
+        protocol = if name.start_with?("tcp.")
+          "tcp"
+        elsif name.start_with?("udp.")
+          "udp"
+        else
+          name.split(".").first
+        end
+        return [] unless layer?(number, protocol)
+
+        offset = ((number - 1) * SIZE) + 12
+        if name.end_with?(".port")
+          [@data.unpack1("l<", offset: offset), @data.unpack1("l<", offset: offset + 4)].reject(&:negative?)
+        else
+          offset += 4 unless name.end_with?("srcport")
+          [@data.unpack1("l<", offset: offset)].reject(&:negative?)
+        end
+      end
+    end
+
+    class AnnotationStore
+      FLAGS = %w[retransmission out_of_order lost_segment duplicate_ack zero_window keep_alive].freeze
+      FORMAT = "q<q<q<L<Cx3"
+      SIZE = 32
+      attr_reader :streams #: Hash[Integer, Array[Integer]]
+      attr_reader :experts #: Hash[Integer, Array[Hash[Symbol, untyped]]]
+      # @rbs! @extra: Hash[Integer, Hash[String, untyped]]
+      # @rbs! @io: File?
+      # @rbs (String directory, ?persist: bool) -> void
+      def initialize(directory, persist: true)
+        @data = +"".b
+        @extra, @streams, @experts = {}, Hash.new { |hash, key| hash[key] = [] }, {}
+        @io = File.open(File.join(directory, "annotations.bin"), "wb", 0o600) if persist
+      end
+      # @rbs (Integer number, annotation_values annotation) -> void
+      def append(number, annotation)
+        flags = FLAGS.each_with_index.sum { |name, index| annotation[:analysis_flags].include?(name) ? 1 << index : 0 }
+        record = [annotation[:tcp_stream], annotation[:seq_rel], annotation[:ack_rel], flags, annotation[:expert_max]].pack(FORMAT)
+        @data << record
+        @io&.write(record)
+        @streams[annotation[:tcp_stream]] << number if annotation[:tcp_stream] >= 0
+        @experts[number] = annotation[:expert_items] unless annotation[:expert_items].empty?
+        @extra[number] = annotation[:extra] unless annotation[:extra].empty?
+      end
+      # @rbs () -> Hash[Symbol, untyped]
+      def drain
+        batch = {data: @data, extras: @extra, streams: @streams.transform_values { |numbers| numbers }, experts: @experts}
+        @data = +"".b
+        @extra, @streams, @experts = {}, Hash.new { |hash, key| hash[key] = [] }, {}
+        batch
+      end
+      # @rbs (Hash[Symbol, untyped] batch) -> void
+      def import(batch)
+        raise Vanken::Error, "invalid annotation batch" unless batch[:data].bytesize % SIZE == 0
+        @io&.write(batch[:data])
+        @data << batch[:data]
+        @extra.merge!(batch[:extras])
+        @experts.merge!(batch[:experts])
+        batch[:streams].each { |stream, numbers| @streams[stream].concat(numbers) }
+      end
+      # @rbs (Integer number) -> annotation_values
+      def [](number)
+        stream, seq, ack, flags, expert = @data.byteslice((number - 1) * SIZE, SIZE).unpack(FORMAT)
+        {tcp_stream: stream, seq_rel: seq, ack_rel: ack, expert_max: expert,
+         analysis_flags: FLAGS.each_with_index.filter_map { |name, index| name if flags & (1 << index) != 0 },
+         expert_items: @experts.fetch(number, []), extra: @extra.fetch(number) { Hash.new }}
+      end
+      # @rbs () -> void
+      def flush = @io&.flush
+      # @rbs (String path) -> String
+      def snapshot(path)
+        flush
+        File.open(path, "w", 0o600) { |io| io.write(JSON.generate("experts" => @experts, "extras" => @extra)) }
+        path
+      end
+      # @rbs () -> void
+      def close = @io&.close
+    end
+
+    class RowCache
+      # @rbs! @entries: Hash[untyped, untyped]
+      # @rbs (?limit: Integer) -> void
+      def initialize(limit: 20_000)
+        @limit = limit
+        @entries = {} #: Hash[untyped, untyped]
+        @mutex = Mutex.new
+      end
+      # @rbs [T] (untyped key) { () -> T } -> T
+      def fetch(key)
+        cached = @mutex.synchronize { value = @entries.delete(key); @entries[key] = value if value; value }
+        return cached if cached
+        value = yield
+        @mutex.synchronize { @entries[key] = value; @entries.shift while @entries.size > @limit }
+        value
+      end
+      # @rbs () -> void
+      def clear = @mutex.synchronize { @entries.clear }
+    end
+  end
+end

data/lib/vanken/errors.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Vanken
+  class Error < StandardError; end
+  class FileError < Error; end
+  class CaptureError < Error; end
+  class ConfigError < Error; end
+  class FilterError < Error; end
+end

data/lib/vanken/gateway/capture_filter.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "redhound"
+
+module Vanken
+  module Gateway
+    module CaptureFilter
+      class Error < StandardError
+        attr_reader :position #: Integer?
+
+        # @rbs (String message, ?position: Integer?) -> void
+        def initialize(message, position: nil)
+          @position = position
+          super(message)
+        end
+      end
+
+      # @rbs (String expression, ?linktype: Integer, ?snaplen: Integer, ?live: bool) -> Redhound::Filter::Program
+      def self.compile(expression, linktype: 1, snaplen: 262_144, live: false)
+        raise Error, "capture filter exceeds 8192 bytes" unless expression.is_a?(String) && expression.bytesize <= 8192
+
+        program = Redhound::Filter.compile(expression, linktype: linktype, snaplen: snaplen, live: live)
+        Redhound::Filter::BPF::Validator.validate!(program.instructions)
+        program
+      rescue Redhound::FilterError => e
+        raise Error.new(e.message, position: e.is_a?(Redhound::FilterSyntaxError) ? e.position : nil)
+      end
+    end
+  end
+end

data/lib/vanken/gateway/detail_builder.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "json"
+
+module Vanken
+  module Gateway
+    class DetailBuilder
+      # @rbs (PacketView packet, ?annotations: Core::annotation_values?) -> Array[Core::DetailNode]
+      def build(packet, annotations: nil)
+        raw = packet.raw_packet
+        frame = node("frame", "Frame #{raw.number}: #{raw.original_length} bytes on wire, #{raw.caplen} captured", offset: 0, length: raw.caplen)
+        nodes = packet.layers.each_with_index.map do |layer, index|
+          prefix = packet.layers.count { |item| item.protocol == layer.protocol } > 1 ? "#{layer.protocol}[#{index}]" : layer.protocol.to_s
+          klass = Redhound::Registry.default.protocols[layer.protocol]
+          source = packet.layer_source(layer)
+          children = layer.fields.map do |field|
+            value = field.value
+            node("#{prefix}/#{field.name}", "#{field.name.split('.').last.tr('_', ' ').capitalize}: #{field.display}",
+              field: field.name, offset: field.length.positive? ? field.offset : nil, length: field.length,
+              source: source,
+              filter: "#{field.name} == #{literal(value, field.type)}")
+          end
+          layer.diagnostics.each_with_index do |item, position|
+            children << node("#{prefix}/expert/#{position}", "[#{Severity.normalize(item.severity)}: #{item.code}] #{escape(item.message)}", source: source, severity: Severity.normalize(item.severity))
+          end
+          node(prefix, klass&.protocol_name || layer.protocol.to_s.upcase, offset: layer.offset,
+            length: layer.payload_end - layer.offset, source: source, children: children)
+        end
+        if annotations
+          annotations[:extra].each do |field, value|
+            next if packet.values(field).any?
+            nodes << node("annotation/#{field}", "[#{field}: #{escape(value)}]", field: field, filter: "#{field} == #{literal(value)}")
+          end
+        end
+        [frame, *nodes]
+      end
+
+      private
+      # @rbs (untyped value, ?Symbol? type) -> String
+      def literal(value, type = nil)
+        return value.to_s if %i[ipv4 ipv6 mac].include?(type) || !value.is_a?(String)
+        return "0x#{value.unpack1('H*')}" if type == :bytes && !value.empty?
+
+        escaped = value.b.bytes.map do |byte|
+          case byte
+          when 34 then '\\"'
+          when 92 then "\\\\"
+          when 32..126 then byte.chr
+          else format("\\x%02x", byte)
+          end
+        end.join
+        "\"#{escaped}\""
+      end
+      # @rbs (untyped value) -> String
+      def escape(value) = value.to_s.b.gsub(/[^\x20-\x7e]/n) { |byte| format("\\x%02x", byte.getbyte(0)) }
+      # @rbs (String id, String label, ?field: String?, ?offset: Integer?, ?length: Integer, ?source: Symbol, ?severity: Symbol?, ?filter: String?, ?children: Array[Core::DetailNode]) -> Core::DetailNode
+      def node(id, label, field: nil, offset: nil, length: 0, source: :frame, severity: nil, filter: nil, children: [])
+        Core::DetailNode.new(id: id, label: label, field: field, offset: offset, length: length, source: source, severity: severity, filter: filter, children: children)
+      end
+    end
+  end
+end

data/lib/vanken/gateway/dissector.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+require "redhound"
+require "stringio"
+require_relative "packet_snapshot"
+
+module Vanken
+  module Gateway
+    PROTOCOLS = {"ip" => :ipv4}.freeze
+    module Severity
+      # @rbs (Symbol? value) -> Symbol?
+      def self.normalize(value) = value == :warn ? :warning : value
+      # @rbs (Symbol? value) -> Integer
+      def self.rank(value) = {nil => 0, note: 1, warning: 2, warn: 2, error: 3}.fetch(value, 0)
+    end
+
+    class Dissector
+      attr_reader :registry #: Redhound::Registry
+      # @rbs (?verify_checksums: bool, ?decode_as: Array[String], ?plugins: Array[String]) -> void
+      def initialize(verify_checksums: false, decode_as: [], plugins: [])
+        plugins.each { |path| load File.expand_path(path) }
+        @registry = Redhound::Registry.default.copy
+        decode_as.each { |rule| @registry.decode_as(rule) }
+        @engine = Redhound::Engine.new(registry: @registry, verify_checksums: verify_checksums)
+      end
+      # @rbs (Core::Frame frame) -> PacketView
+      def dissect(frame)
+        packet = self.class.packet(frame)
+        packet.engine = @engine
+        PacketView.new(packet, @registry)
+      rescue Redhound::Error, ArgumentError => error
+        raise Vanken::FileError, error.message
+      end
+      # @rbs (Core::Frame frame, ?interfaces: Hash[Hash[String, untyped], Redhound::Capture::Interface]) -> Redhound::Packet
+      def self.packet(frame, interfaces: {})
+        interface = frame.interface && interfaces.fetch(frame.interface) do
+          values = frame.interface.transform_keys(&:to_sym).select { |key, _| %i[name index linktype snaplen flags mtu mac description filter meta].include?(key) }
+          interfaces[frame.interface] = Redhound::Capture::Interface.new(name: values.fetch(:name), **values.reject { |key, _| key == :name })
+        end
+        Redhound.dissect(frame.bytes, linktype: frame.linktype, timestamp_ns: frame.timestamp_ns,
+          original_length: frame.original_length, interface: interface, direction: frame.direction, number: frame.number)
+      end
+    end
+
+    class PacketView
+      attr_reader :raw_packet #: Redhound::Packet
+      # @rbs (Redhound::Packet packet, Redhound::Registry registry) -> void
+      def initialize(packet, registry) = (@raw_packet = packet; @registry = registry)
+      # @rbs (String name) -> Array[untyped]
+      def values(name) = FieldValues.read(name) { |field| @raw_packet.field_values(field) }
+      # @rbs (String name) -> bool
+      def layer?(name) = @raw_packet.layers.any? { |layer| layer.protocol == PROTOCOLS.fetch(name, name.to_sym) }
+      # @rbs () -> Array[Redhound::Field]
+      def fields = @raw_packet.layers.flat_map(&:fields)
+      # @rbs (String name) -> Symbol?
+      def field_type(name) = fields.find { |field| field.name == name }&.type
+      # @rbs () -> Array[Redhound::Layer]
+      def layers = @raw_packet.layers
+      # @rbs () -> String
+      def bytes = @raw_packet.data
+      # @rbs () -> Hash[Symbol, untyped]
+      def to_h = @raw_packet.to_h
+      # @rbs () -> Array[Hash[Symbol, untyped]]
+      def diagnostics
+        layers.flat_map do |layer|
+          layer.diagnostics.map { |item| {severity: Severity.normalize(item.severity), code: item.code.to_s,
+                                         protocol: layer.protocol.to_s, message: safe_text(item.message)} }
+        end
+      end
+      # @rbs () -> Core::column_values
+      def columns
+        relevant = layers.reject(&:embedded)
+        network = relevant.reverse.find { |layer| %i[ipv4 ipv6].include?(layer.protocol) }
+        address = network || relevant.find { |layer| layer.protocol == :arp } || relevant.find { |layer| layer.protocol == :eth }
+        transport = relevant.reverse.find { |layer| %i[tcp udp].include?(layer.protocol) }
+        meaning = relevant.reverse.find { |layer| !%i[data raw eth vlan ipv6_ext sll sll2 null].include?(layer.protocol) } || relevant.last
+        klass = meaning && @registry.protocols[meaning.protocol]
+        {source: address_text(address, :src), destination: address_text(address, :dst),
+         protocol: (klass&.short_name || meaning&.protocol.to_s.upcase),
+         src_port: transport&.[](:srcport) || -1, dst_port: transport&.[](:dstport) || -1,
+         ip_proto: network&.[](:proto) || network&.[](:nxt) || -1,
+         layers: layers.map { |layer| layer.protocol == :ipv4 ? "ip" : layer.protocol.to_s }.uniq,
+         transport_values: layers.count { |layer| %i[tcp udp].include?(layer.protocol) } > 1 ?
+           %w[tcp.srcport tcp.dstport udp.srcport udp.dstport].to_h { |name| [name, values(name)] } : nil}
+      end
+      # @rbs () -> String
+      def info
+        safe_text(@raw_packet.summary)
+      end
+      # @rbs () -> Core::annotation_values
+      def annotations
+        extra = fields.select { |field| field.name.start_with?("tcp.analysis.", "tcp.reassembled", "ip.reassembled") }.to_h { |field| [field.name, field.value] }
+        {tcp_stream: values("tcp.stream").first || -1, seq_rel: values("tcp.seq_relative").first || -1,
+         ack_rel: values("tcp.ack_relative").first || -1,
+         analysis_flags: Core::AnnotationStore::FLAGS.select { |flag| values("tcp.analysis.#{flag}").any? },
+         expert_max: diagnostics.map { |item| Severity.rank(item[:severity]) }.max || 0,
+         expert_items: diagnostics, extra: extra}
+      end
+      # @rbs () -> bool
+      def reassembled? = @raw_packet.meta.key?(:reassembled_packet) || fields.any? { |field| field.name == "tcp.reassembled_from" }
+      # @rbs (Redhound::Layer layer) -> (:frame | :reassembled)
+      def layer_source(layer)
+        virtual = @raw_packet.meta[:reassembled_packet]
+        return :reassembled if (virtual && virtual.layers.include?(layer)) || layer.field_value("tcp.reassembled_in")
+
+        :frame
+      end
+
+      private
+      # @rbs (untyped value) -> String
+      def safe_text(value) = value.to_s.b.gsub(/[^\x20-\x7e]/n) { |byte| format("\\x%02x", byte.getbyte(0)) }
+      # @rbs (Redhound::Layer? layer, Symbol direction) -> String
+      def address_text(layer, direction)
+        return "" unless layer
+        key = layer.protocol == :arp ? (direction == :src ? :spa : :tpa) : direction
+        layer.display(key)
+      end
+    end
+
+    class Analysis
+      # @rbs (?registry: Redhound::Registry, **untyped options) -> void
+      def initialize(registry: Redhound::Registry.default, **options)
+        @session = Redhound::Analysis::Session.new(registry: registry, stats: [], **options)
+      end
+      # @rbs (PacketView packet) -> void
+      def update(packet) = @session.update(packet.raw_packet)
+      # @rbs () -> void
+      def close
+        @session.finish(StringIO.new, StringIO.new)
+      end
+    end
+
+    class FieldCatalog
+      # @rbs () -> void
+      def initialize
+        @mutex = Mutex.new
+        @fields = {} #: Hash[String, Hash[Symbol, untyped]]
+        @protocols = Redhound::Registry.default.protocols.keys.map { |id| id == :ipv4 ? "ip" : id.to_s }
+        Redhound::Registry.default.protocols.each do |id, klass|
+          definitions = Array(klass.compiled_header&.definitions) #: Array[Redhound::FieldDefinition]
+          definitions.each do |field|
+            @fields[field.name] = {type: field.type, source: :dissect, protocol: id.to_s}.freeze
+          end
+        end
+        @names = (@fields.keys + @protocols).sort.freeze
+      end
+      # @rbs () -> Array[String]
+      def names = @mutex.synchronize { @names }
+      # @rbs (String name) -> Hash[Symbol, untyped]?
+      def lookup(name) = @mutex.synchronize { @fields[name] }
+      # @rbs (String name) -> bool
+      def protocol?(name) = @protocols.include?(name)
+      # @rbs (PacketView packet) -> void
+      def observe(packet)
+        fields = packet.fields
+        @mutex.synchronize do
+          changed = false
+          fields.each do |field|
+            next if @fields.key?(field.name)
+            @fields[field.name] = {type: field.type, source: :dissect, protocol: field.name.split(".").first}.freeze
+            changed = true
+          end
+          @names = (@fields.keys + @protocols).sort.freeze if changed
+        end
+      end
+      # @rbs (Hash[String, Hash[Symbol, untyped]] definitions) -> void
+      def merge(definitions)
+        @mutex.synchronize do
+          definitions.each { |name, definition| @fields[name] ||= definition.freeze }
+          @names = (@fields.keys + @protocols).sort.freeze unless definitions.empty?
+        end
+      end
+    end
+  end
+end