<commit_before># parsing outline (draft)

## inputs

### necessary fields

Parser will take a field list from Modeler and enable them in the `node-pcap`
call options. Specifically, Parser accepts a list of key names to parse from
analyzed packets, organized by protocol, in JSON.

TODO: example

### environment vars

Parser looks for `$NET_INTERFACE` and brings up a `pcap` session on that
interface.

## output format

Parser will return an object in JSON with keys named according to conventions
established by `pcap` and `node_pcap` unless not applicable. Specifically, it
will parse and return keys as required by Modeler at startup (i.e., according to
the needs of installed models).

At a minimum, the following keys will always be returned:

- Timestamp
- Protocol
- Destination Address<commit_msg>Updated parsing spec to match model spec<commit_after># parsing outline (draft)

## inputs

### necessary fields

Parser will take a field list from Modeler and enable them in the `node-pcap`
call options. Specifically, Parser accepts a list of key names to parse from
analyzed packets, organized by protocol, in JSON.

TODO: example

### environment vars

Parser looks for `$NET_INTERFACE` and brings up a `pcap` session on that
interface.

## output format

Parser will return an object in JSON with keys named according to conventions
established by `pcap` and `node_pcap` unless not applicable. Specifically, it
will parse and return keys as required by Modeler at startup (i.e., according to
the needs of installed models).

At a minimum, the following keys will always be returned if present:

- Timestamp `pcap_header.time_ms`
- Protocol `link_type`, `link.ip.protocol_name`
- Destination Address `link.ip.daddr`, `link.dhost` (MAC)
- Destination Port `link.ip.tcp.dport`
- Source Address `link.ip.saddr`, `link.shost` (MAC)
- Source Port `link.ip.tcp.sport`
{'fraction_non_alphanumeric': 0.07429182255478353, 'fraction_numerical': 0.0, 'mean_word_length': 4.621621621621622, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7616671', 'n_tokens_mistral': 525, 'n_tokens_neox': 511, 'n_words': 256}