yfIPFragInfo_st Struct Reference

#include <decode.h>

Data Fields

uint32_t ipid
 Fragment ID. More...
 
uint16_t offset
 Fragment offset within the reassembled datagram.
 
uint16_t iphlen
 IP header length. More...
 
uint16_t l4hlen
 Decoded header length. More...
 
uint8_t frag
 Fragmented packet flag. More...
 
uint8_t more
 More fragments flag. More...
 

Detailed Description

Packet decoding interface for YAF.

This file's single function decodes IPv4 and IPv6 packets within loopback, raw, Ethernet, Linux SLL ("cooked"), and C-HDLC frames, encapsulated within MPLS, 802.1q VLAN, and/or GRE. It provides high-performance partial reassembly of IPv4 and IPv6 fragments to properly generate flows from fragmented data, and to support the export of the first N bytes of a given flow.

The structures filled in by yfDecodePkt() are used within the flow generator, and are suitable for other similar purposes. Fragmentation information structure

Field Documentation

◆ frag

uint8_t yfIPFragInfo_st::frag

Fragmented packet flag.

Set if the packet is a fragment, clear if it is complete.

◆ iphlen

uint16_t yfIPFragInfo_st::iphlen

IP header length.

Used to calculate total fragment length.

◆ ipid

uint32_t yfIPFragInfo_st::ipid

Fragment ID.

This is a 32-bit integer to support both IPv4 and IPv6.

◆ l4hlen

uint16_t yfIPFragInfo_st::l4hlen

Decoded header length.

Number of bytes at the start of the packet not represented in the associated packet data.

◆ more

uint8_t yfIPFragInfo_st::more

More fragments flag.

Set if this fragment is not the last in the packet.


The documentation for this struct was generated from the following file: