#include <decode.h>
Data Fields | |
uint32_t | ipid |
Fragment ID. More... | |
uint16_t | offset |
Fragment offset within the reassembled datagram. | |
uint16_t | iphlen |
IP header length. More... | |
uint16_t | l4hlen |
Decoded header length. More... | |
uint8_t | frag |
Fragmented packet flag. More... | |
uint8_t | more |
More fragments flag. More... | |
Packet decoding interface for YAF.
This file's single function decodes IPv4 and IPv6 packets within loopback, raw, Ethernet, Linux SLL ("cooked"), and C-HDLC frames, encapsulated within MPLS, 802.1q VLAN, and/or GRE. It provides high-performance partial reassembly of IPv4 and IPv6 fragments to properly generate flows from fragmented data, and to support the export of the first N bytes of a given flow.
The structures filled in by yfDecodePkt() are used within the flow generator, and are suitable for other similar purposes. Fragmentation information structure
uint8_t yfIPFragInfo_st::frag |
Fragmented packet flag.
Set if the packet is a fragment, clear if it is complete.
uint16_t yfIPFragInfo_st::iphlen |
IP header length.
Used to calculate total fragment length.
uint32_t yfIPFragInfo_st::ipid |
Fragment ID.
This is a 32-bit integer to support both IPv4 and IPv6.
uint16_t yfIPFragInfo_st::l4hlen |
Decoded header length.
Number of bytes at the start of the packet not represented in the associated packet data.
uint8_t yfIPFragInfo_st::more |
More fragments flag.
Set if this fragment is not the last in the packet.