[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-183128-105":59,"doc-detail-183128-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","event-handler-and-management-logic","Event handler and management logic","","This document details event handling mechanisms and flow management logic within a network system, focusing on different event types and their descriptions. It outlines user-defined and built-in events, including packet arrivals, connection initiations, retransmissions, state changes, and terminations. The document also presents a detailed breakdown of various events and their corresponding descriptions, such as MOS_ON_PKT_IN for in-flow TCP packet arrival and MOS_ON_CONN_START for connection initiation. Furthermore, it elaborates on specific event handlers, linking them to functions like IsFakeRexmit() and AccountDataUsage(). The paper also includes a comparative analysis of different applications like Snort, nDPI, PRADS, and Abacus, evaluating them based on modifications, source lines of code (SLOC), and their output in terms of stateful inspection and session management. The graphical representations further solidify the understanding of these event-driven processes and their intricate relationships within network operations.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/event-handler-and-management-logic/183128/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/event-handler-and-management-logic/183128.png","ImageObject",300,407,{"name":92,"@type":93},"Felix Montgomery","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-08","2026-09-02",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",12,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What are the different types of events mentioned in the document?","Question",{"text":113,"@type":114},"The document describes user-defined and built-in events. User-defined events include monitoring sockets, while built-in events encompass per-flow state and flow management logic. Specific events like packet arrival, connection initiation, retransmission, state change, and termination are also detailed.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"What is the purpose of the `HandleFakeRexmitPacket()` function?",{"text":118,"@type":114},"The `HandleFakeRexmitPacket()` function is associated with the event `e3` (UDE_FAKE_REXMIT), suggesting it is designed to handle or process specific types of retransmission events that might be faked or otherwise special.",{"name":120,"@type":111,"acceptedAnswer":121},"How are different applications compared in the document?",{"text":122,"@type":114},"The document compares applications such as Snort, nDPI, PRADS, and Abacus based on the extent of their modifications, the number of source lines of code (SLOC), and their output capabilities. For example, Snort provides stateful HTTP/TCP inspection, while others focus on stateful session management or detecting out-of-order packet tunneling.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},183128,1788351384,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":56,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":130,"read_time":144},549768064778,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","| Event handler |  |  |  |  |\n| --- | --- | --- | --- | --- |\n| User-defined event |  |  |  | \u003Cbr>Monitoring socket |\n|  |  |  |  |  |\n|  |  |  |  |  |\n| Built-in event |  | Per-flow state |  |  |\n| Flow management logic (Layer 2 ~ 4) |  |  |  |  |\n\n| Event | Description |\n| --- | --- |\n| MOS_ON_PKT_IN | In-flow TCP packet arrival |\n| MOS_ON_CONN_START | Connection initiation (the first SYN packet) |\n| MOS_ON_REXMIT | TCP packet retransmission |\n| MOS_ON_TCP_STATE_CHANGE | TCP state transition |\n| MOS_ON_CONN_END | Connection termination |\n| MOS_ON_CONN_NEW_DATA | Availability of new flow-reassembled data |\n| MOS_ON_ORPHAN | Out-of-flow (or non-TCP) packet arrival |\n| MOS_ON_ERROR | Error report (e.g., receive buffer full) |\n\n| e1 | MOS_ON_REXMIT |\n| --- | --- |\n| e2 | MOS_ON_CONN_NEW_DATA |\n| e3 | UDE_FAKE_REXMIT |\n| FTFAKE | IsFakeRexmit() |\n| fa | HandleFakeRexmitPacket() |\n| fb | AccountDataUsage() |\n\n| IF1 | e1\u003Cbr>e2\u003Cbr>\u003Cbr>f2 | e3\u003Cbr>e4\u003Cbr>e5\u003Cbr>\u003Cbr>\u003Cbr>f5 |\n| --- | --- | --- |\n| id1 = h(e2+f2)⊕h(e5+f5) |  |  |\n\n| Appl | Modified | SLOC | Output |\n| --- | --- | --- | --- |\n| Snort | 2, 104 | 79, 889 | Stateful [HTTP/TCP inspection](HTTP/TCP inspection) |\n| nDPI | 765 | 25, 483 | Stateful session management |\n| PRADS | 615 | 10, 848 | Stateful session management |\n| Abacus | - | 4, 639 → 561 | Detect out-of-order packet tunneling |","cbCaiaYP0rRxTYzk","https://ap.wps.com/l/cbCaiaYP0rRxTYzk","pdf",2560366,"English","# Event handler\n# Event\n# e1\n# IF1\n# Appl","[{\"question\":\"What are the different types of events mentioned in the document?\",\"answer\":\"The document describes user-defined and built-in events. User-defined events include monitoring sockets, while built-in events encompass per-flow state and flow management logic. Specific events like packet arrival, connection initiation, retransmission, state change, and termination are also detailed.\"},{\"question\":\"What is the purpose of the `HandleFakeRexmitPacket()` function?\",\"answer\":\"The `HandleFakeRexmitPacket()` function is associated with the event `e3` (UDE_FAKE_REXMIT), suggesting it is designed to handle or process specific types of retransmission events that might be faked or otherwise special.\"},{\"question\":\"How are different applications compared in the document?\",\"answer\":\"The document compares applications such as Snort, nDPI, PRADS, and Abacus based on the extent of their modifications, the number of source lines of code (SLOC), and their output capabilities. For example, Snort provides stateful HTTP/TCP inspection, while others focus on stateful session management or detecting out-of-order packet tunneling.\"}]","Event handler and management logic | PDF",48]