Build a protocol plugin

Create an independent Go or Rust Wasm project without editing NetFlowScout. The host handles reassembly, connection lifecycle, attribution, rules, and delivery. Your plugin implements framing, protocol state, and request/response correlation.

Create a Go plugin

Install official Go ≥ 1.24 and a NetFlowScout CLI executable for your development machine. TinyGo is unnecessary:

netflowscout plugin init --language go --directory ./acme-tcp --template tcp --port 19090
cd acme-tcp
sh build.sh
NETFLOWSCOUT=/absolute/path/netflowscout sh test.sh

Call plugin.Register(process) in init() and emit with plugin.Emit / EmitJSON. Builds use wasip1/wasm -buildmode=c-shared. Reactor initialization does not call main. Do not start background goroutines, sleep, or wait for I/O. The SDK advances runtime scheduling after callbacks; upgrading it requires recompiling Wasm.

Create Rust or UDP plugins

netflowscout plugin init --directory ./acme-udp --template udp --port 19091
cd acme-udp
rustup target add wasm32-unknown-unknown
sh build.sh
sh test.sh

Rust is the default. Use export_plugin!(process), emit_json, and quote; the SDK needs no external crates. The target directory must not exist. Names match [a-z][a-z0-9_]{0,39}, derived from the directory with hyphens converted to underscores by default.

Project and development loop

File	Responsibility
main.go / parser.go or src/lib.rs	State machine, direction, and correlation queues
sdk/	Independent SDK and API docs; the whole project is relocatable
manifest.json	Unique protocol, ports, version, resource limits, optional detection
schema.json	Record types, string/number/bool fields, sensitivity
fixtures/	Synthetic replay input and manually reviewed expected output
rules.nfs / netflowscout.json	Isolated development rules and configuration
dist/	Installable manifest, Wasm, and schema after building

The TCP template splits on LF. Test fragments, coalesced messages, interleaved directions, gaps, closure, and limits. UDP parses complete datagrams, including empty ones. These are minimal text examples, not universal production protocol semantics.

test.sh runs actual Wasm golden replays and compares type, fields, incomplete, and truncated without queueing or external delivery. Expected files contain plaintext: use synthetic or sanitized data. Do not regenerate golden results automatically with the parser under test.

Install and activate

sudo netflowscout plugin install --source ./dist \
  --directory /usr/local/lib/netflowscout/plugins/acme_tcp
sudo netflowscout check --config /etc/netflowscout/netflowscout.json

Add the installed directory or parent to production plugins and add rules as needed. Do not overwrite production with the development configuration.

• New schemas or changed field types/sensitivity require coordinated restarts of the main service and analyzer.
• Compatible updates with the same schema can increment version, build/test/install/check, then reload the analyzer.

sudo systemctl reload netflowscout-analyzer.service
netflowscout plugin info --config /etc/netflowscout/netflowscout.json

A successful reload command only confirms signal delivery. Check active hashes and new requests. New connections use the new generation; old ones retain their original parser until drained. Failure retains the previous set. Use plugin rollback --directory ..., then check/reload, to restore a package.

Connect TLS plaintext

Set main application_source=endpoint and point endpoint plugins at the same packages. Templates default to explicit ports. Add reliable magic bytes through manifest detection for unknown TCP ports and endpoint auto-detection. Restart discovery after signature changes. Probes obtain plaintext; protocol plugins do not decrypt TLS themselves.

See the plugin contract for lifecycle, resources, and output. Administrators review and install plugins; there is no public marketplace or signing trust chain yet.