Lua Scripting Plugin

-- Netify Lua Processor Example Script
-- Copyright (C) 2026 eGloo, Incorporated

FLOWS = { }

function TableToCSV(t)
  local escape = function(s)
    if string.find(s, '[,"]') then
      s = '"' .. string.gsub(s, '"', '""') .. '"'
    end
    return s
  end

  local csv = ''
  for _, r in ipairs(t) do
    local row = ''
    for _, c in ipairs(r) do
      row = row .. ',' .. escape(c)
    end
    csv = csv .. string.sub(row, 2) .. "\n"
  end

  return csv
end

function ResetFlows()
  FLOWS = {
    {
      "iface", "digest", "lower_mac", "lower_addr", "lower_port",
      "upper_mac", "upper_addr", "upper_port", "ip_protocol",
      "detected_protocol", "detected_application"
    }
  }
end

-- Process an Agent event.
function ProcessAgentEvent(event)
  local message = 'Agent event: '

  if event == NPP_EVENT_UPDATE_INIT then
    message = message .. 'update'
  elseif event == NPP_EVENT_UPDATE_COMPLETE then
    message = message .. 'update complete'

    if #FLOWS > 1 then
      npp.dispatch(
        'sink-log', { 'lua-csv' },
        TableToCSV(FLOWS),
        NPP_FORMAT_RAW,
        NPP_COMPRESSOR_NONE
      )
      ResetFlows()
    end
  else
    message = message .. string.format('unknown [%d]', event)
  end

  npp.debug(message)
end

-- Process a flow event.
function ProcessFlowEvent(event, flows)
  if event ~= NPP_EVENT_DPI_COMPLETE then
    return
  end

  for _, flow in ipairs(flows) do
    table.insert(FLOWS,
      {
        flow['iface']['name'], flow['digest_mdata'],
        flow['lower_mac'], flow['lower_addr'], flow['lower_port'],
        flow['upper_mac'], flow['upper_addr'], flow['upper_port'],
        flow['ip_protocol'], flow['detected_protocol'], flow['detected_application']
      }
    )
  end
end

function ProcessFlowStats(flows)
    local active_flows = 0
    local total_bytes = 0
    local lower_rate = 0.0
    local upper_rate = 0.0

    for _, flow in ipairs(flows) do
      if flow['stats']['lower_bytes'] > 0 or flow['stats']['upper_bytes'] > 0 then
        active_flows = active_flows + 1
        total_bytes = total_bytes + flow['stats']['total_bytes']
        lower_rate = lower_rate + flow['stats']['lower_rate']
        upper_rate = upper_rate + flow['stats']['upper_rate']
      end
    end

    npp.debug(
      string.format(
        "active flows: %d, total bytes: %d, lower rate: %.1f, upper rate: %.1f",
        active_flows, total_bytes, lower_rate, upper_rate
      )
    )
end

ResetFlows()

npp.print('Netify Lua Processor Example: initialized')