# `Linx.Netfilter.Log.Event`
[🔗](https://github.com/oshlabs/linx/blob/v0.2.0/lib/linx/netfilter/log.ex#L341)

A decoded NFLOG packet event.

Fields populated from `NFULA_*` attributes. All optional —
the kernel only includes attributes it has data for, and
the consumer's `:copy_mode` controls whether `:payload` is
present.

  * `:group` — NFLOG group the event came from (filled by
    the listener, not the kernel).
  * `:prefix` — string label from the rule's
    `Expr.log(prefix: ...)`. `nil` if the rule didn't set one.
  * `:hook` — `NF_INET_*` hook number where the packet was
    captured.
  * `:hw_protocol` — Ethernet protocol (`0x0800` = IPv4,
    `0x86dd` = IPv6, etc.).
  * `:mark` — packet mark, if `meta mark` was set on the path.
  * `:timestamp` — `{seconds, microseconds}` since the epoch.
  * `:indev` / `:outdev` — interface ifindex of arrival /
    departure.
  * `:physindev` / `:physoutdev` — for bridged packets.
  * `:hwaddr` — source link-layer address (bytes).
  * `:payload` — packet bytes from the network header down (or
    nil if `:copy_mode` was `:meta`/`:none`).
  * `:uid` / `:gid` — owner of the originating local socket,
    if any (only meaningful for OUTPUT-hook captures).
  * `:seq` / `:seq_global` — sequence numbers if `:seq` /
    `:seq_global` flag was set on the listener.

# `t`

```elixir
@type t() :: %Linx.Netfilter.Log.Event{
  gid: non_neg_integer() | nil,
  group: 1..65535 | nil,
  hook: 0..255 | nil,
  hw_protocol: 0..65535 | nil,
  hwaddr: binary() | nil,
  indev: non_neg_integer() | nil,
  mark: non_neg_integer() | nil,
  outdev: non_neg_integer() | nil,
  payload: binary() | nil,
  physindev: non_neg_integer() | nil,
  physoutdev: non_neg_integer() | nil,
  prefix: String.t() | nil,
  seq: non_neg_integer() | nil,
  seq_global: non_neg_integer() | nil,
  timestamp: {non_neg_integer(), non_neg_integer()} | nil,
  uid: non_neg_integer() | nil
}
```

# `decode`

```elixir
@spec decode(binary()) :: t()
```

Decodes a `NFULNL_MSG_PACKET` body into a `%Log.Event{}`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*