75 #ifndef _YAF_DECODE_H_
76 #define _YAF_DECODE_H_
78 #include <yaf/autoinc.h>
106 #define YF_MPLS_LABEL_COUNT_MAX 3
156 # if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
171 #define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
174 #define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
177 #define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
179 struct yfDecodeCtx_st;
181 typedef struct yfDecodeCtx_st yfDecodeCtx_t;
184 #define YF_TYPE_IPv4 0x0800
186 #define YF_TYPE_IPv6 0x86DD
191 #define YF_TYPE_IPANY 0x0000
194 #define YF_PROTO_IP6_HOP 0
196 #define YF_PROTO_ICMP 1
198 #define YF_PROTO_TCP 6
200 #define YF_PROTO_UDP 17
202 #define YF_PROTO_IP6_ROUTE 43
204 #define YF_PROTO_IP6_FRAG 44
206 #define YF_PROTO_GRE 47
208 #define YF_PROTO_ICMP6 58
210 #define YF_PROTO_IP6_NONEXT 59
212 #define YF_PROTO_IP6_DOPT 60
215 #define YF_TF_FIN 0x01
217 #define YF_TF_SYN 0x02
219 #define YF_TF_RST 0x04
221 #define YF_TF_PSH 0x08
223 #define YF_TF_ACK 0x10
225 #define YF_TF_URG 0x20
227 #define YF_TF_ECE 0x40
229 #define YF_TF_CWR 0x80
249 yfDecodeCtx_t *yfDecodeCtxAlloc(
259 void yfDecodeCtxFree(
297 gboolean yfDecodeToPBuf(
314 uint64_t yfDecodeTimeval(
315 const struct timeval *tv);
325 uint64_t yfDecodeTimeNTP(
335 void yfDecodeDumpStats(
337 uint64_t packetTotal);
345 void yfDecodeResetOffset(
354 uint32_t yfGetDecodeStats(
371 gboolean yfDefragTCP(
uint16_t pcap_caplist
caplist
Definition: decode.h:147
uint8_t flags
TCP flags.
Definition: decode.h:129
uint16_t l4hlen
Decoded header length.
Definition: decode.h:93
uint16_t iplen
Packet IP length.
Definition: decode.h:149
#define YFP_IPTCPHEADER_SIZE
This is the size of the packet to store away for use primarily in passive OS fingerprinting, this value is only used if application labeling is enabled.
Definition: yafcore.h:182
uint32_t ipid
Fragment ID.
Definition: decode.h:84
uint32_t mpls_count
MPLS label count.
Definition: decode.h:119
uint8_t more
More fragments flag.
Definition: decode.h:102
yfFlowKey_t key
Flow key containing decoded IP and transport headers.
Definition: decode.h:137
TCP information structure.
Definition: decode.h:125
uint8_t frag
Fragmented packet flag.
Definition: decode.h:98
yfTCPInfo_t tcpinfo
TCP information structure.
Definition: decode.h:153
size_t allHeaderLen
Length of all headers, L2, L3, L4.
Definition: decode.h:139
size_t paylen
Length of payload available in captured payload buffer.
Definition: decode.h:163
uint64_t ptime
Packet timestamp in epoch milliseconds.
Definition: decode.h:135
Packet decoding interface for YAF.
Definition: decode.h:82
yfL2Info_t l2info
Decoded layer 2 information.
Definition: decode.h:155
uint8_t smac[6]
Source MAC address.
Definition: decode.h:111
uint32_t seq
TCP sequence number.
Definition: decode.h:127
A YAF flow key.
Definition: yafcore.h:202
Datalink layer information structure.
Definition: decode.h:109
uint16_t vlan_tag
VLAN tag.
Definition: decode.h:117
pcap_t * pcapt
pcap struct
Definition: decode.h:143
Full packet information structure.
Definition: decode.h:133
uint16_t iphlen
IP header length.
Definition: decode.h:88
struct pcap_pkthdr pcap_hdr
pcap header
Definition: decode.h:141
uint8_t dmac[6]
Destination MAC address.
Definition: decode.h:113
uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX]
MPLS label stack.
Definition: decode.h:121
uint64_t pcap_offset
offset into pcap
Definition: decode.h:145
uint16_t offset
Fragment offset within the reassembled datagram.
Definition: decode.h:86
uint16_t ifnum
Interface number packet was decoded from.
Definition: decode.h:151
uint8_t payload[1]
Captured payload buffer.
Definition: decode.h:167
uint16_t l2hlen
Layer 2 Header Length.
Definition: decode.h:115