Add tcp connection state string

CHANGELOG.md

@@ -10,6 +10,7 @@ Versioning](https://semver.org/spec/v2.0.0.html).
 ### Changed
 
 - Modified event structure to store NTLM error information.
+- Modified connection event structure to report connection state.
 
 ## [0.15.2] - 2023-11-16
 

src/ingest.rs

@@ -161,6 +161,7 @@ mod tests {
             resp_addr: "192.168.4.76".parse::<IpAddr>().unwrap(),
             resp_port: 80,
             proto: 6,
+            conn_state: String::new(),
             duration: 1000,
             service: "-".to_string(),
             orig_bytes: 77,

src/ingest/network.rs

@@ -17,6 +17,7 @@ pub struct Conn {
     pub resp_addr: IpAddr,
     pub resp_port: u16,
     pub proto: u8,
+    pub conn_state: String,
     pub duration: i64,
     pub service: String,
     pub orig_bytes: u64,
@@ -29,12 +30,13 @@ impl Display for Conn {
     fn fmt(&self, f: &mut Formatter) -> std::fmt::Result {
         write!(
             f,
-            "{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}",
+            "{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}\t{}",
             self.orig_addr,
             self.orig_port,
             self.resp_addr,
             self.resp_port,
             self.proto,
+            as_str_or_default(&self.conn_state),
             convert_time_format(self.duration),
             self.service,
             self.orig_bytes,

src/publish.rs

@@ -540,6 +540,7 @@ mod tests {
             resp_addr: "192.168.4.76".parse::<IpAddr>().unwrap(),
             resp_port: 80,
             proto: 6,
+            conn_state: String::new(),
             duration: 1000,
             service: "-".to_string(),
             orig_bytes: 77,
@@ -695,6 +696,7 @@ mod tests {
             resp_addr: "192.168.4.76".parse::<IpAddr>().unwrap(),
             resp_port: 80,
             proto: 6,
+            conn_state: String::new(),
             duration: 1000,
             service: "-".to_string(),
             orig_bytes: 77,