Overview

The Session Store handles handles Ethernet frames and tcp sessions. Captured raw Ethernet frames are categorized, and filtered by various blacklists and whitelists. The set of frames that belong to a single TCP instance are binned together and sorted. Several other stages of processing later, the TCP payload is presented as a range of bytes for output.

Sockets

Reflector binds promiscuously to a pair of Ethernet sockets and traffics frames between them. It requires exclusive access to both sockets. If any other process (including another Reflector) binds to it, a packet storm can result. As a result, Reflector attempts to negotiate unique access via flock() for the entire duration.

...