76 #ifndef _YAF_DECODE_H_
77 #define _YAF_DECODE_H_
79 #include <yaf/autoinc.h>
107 #define YF_MPLS_LABEL_COUNT_MAX 3
176 # if defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
191 #define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
194 #define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
197 #define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
199 struct yfDecodeCtx_st;
201 typedef struct yfDecodeCtx_st yfDecodeCtx_t;
204 #define YF_TYPE_IPv4 0x0800
206 #define YF_TYPE_IPv6 0x86DD
211 #define YF_TYPE_IPANY 0x0000
214 #define YF_PROTO_IP6_HOP 0
216 #define YF_PROTO_ICMP 1
218 #define YF_PROTO_TCP 6
220 #define YF_PROTO_UDP 17
222 #define YF_PROTO_IP6_ROUTE 43
224 #define YF_PROTO_IP6_FRAG 44
226 #define YF_PROTO_GRE 47
228 #define YF_PROTO_ICMP6 58
230 #define YF_PROTO_IP6_NONEXT 59
232 #define YF_PROTO_IP6_DOPT 60
235 #define YF_TF_FIN 0x01
237 #define YF_TF_SYN 0x02
239 #define YF_TF_RST 0x04
241 #define YF_TF_PSH 0x08
243 #define YF_TF_ACK 0x10
245 #define YF_TF_URG 0x20
247 #define YF_TF_ECE 0x40
249 #define YF_TF_CWR 0x80
252 #define YF_MF_PRIO_CHANGE 0x01
254 #define YF_MF_PRIORITY 0x02
256 #define YF_MF_FAIL 0x04
258 #define YF_MF_FASTCLOSE 0x08
345 const struct timeval *tv);
367 uint64_t packetTotal);
uint32_t token
token
Definition: decode.h:130
size_t allHeaderLen
Length of all headers, L2, L3, L4.
Definition: decode.h:156
uint8_t dmac[6]
Destination MAC address.
Definition: decode.h:114
uint16_t iphlen
IP header length.
Definition: decode.h:89
TCP information structure.
Definition: decode.h:140
yfFlowKey_t key
Flow key containing decoded IP and transport headers.
Definition: decode.h:154
uint16_t mss
maximum segment size
Definition: decode.h:132
yfL2Info_t l2info
Decoded layer 2 information.
Definition: decode.h:175
uint8_t more
More fragments flag.
Definition: decode.h:103
uint16_t offset
Fragment offset within the reassembled datagram.
Definition: decode.h:87
uint8_t flags
TCP flags.
Definition: decode.h:144
#define YFP_IPTCPHEADER_SIZE
This is the size of the packet to store away for use primarily in passive OS fingerprinting,...
Definition: yafcore.h:188
struct pcap_pkthdr pcap_hdr
pcap header
Definition: decode.h:158
A YAF flow key.
Definition: yafcore.h:208
uint16_t iplen
Packet IP length.
Definition: decode.h:166
MPTCP information structure.
Definition: decode.h:126
uint16_t ifnum
Interface number packet was decoded from.
Definition: decode.h:168
pcap_t * pcapt
pcap struct
Definition: decode.h:160
uint8_t payload[1]
Captured payload buffer.
Definition: decode.h:187
uint8_t flags
flags
Definition: decode.h:134
uint32_t seq
TCP sequence number.
Definition: decode.h:142
uint64_t idsn
initial dsn
Definition: decode.h:128
size_t paylen
Length of payload available in captured payload buffer.
Definition: decode.h:183
yfMPTCPInfo_t mptcp
MPTCP Info.
Definition: decode.h:146
uint32_t mpls_label[YF_MPLS_LABEL_COUNT_MAX]
MPLS label stack.
Definition: decode.h:122
uint16_t l2hlen
Layer 2 Header Length.
Definition: decode.h:116
uint16_t l4hlen
Decoded header length.
Definition: decode.h:94
uint16_t pcap_caplist
caplist
Definition: decode.h:164
uint8_t frag
flag for determining if the packet was fragmented 0-no, 1-yes, 2-not fully assembled
Definition: decode.h:171
Full packet information structure.
Definition: decode.h:150
uint64_t pcap_offset
offset into pcap
Definition: decode.h:162
Packet decoding interface for YAF.
Definition: decode.h:83
uint32_t ipid
Fragment ID.
Definition: decode.h:85
uint32_t mpls_count
MPLS label count.
Definition: decode.h:120
Datalink layer information structure.
Definition: decode.h:110
yfTCPInfo_t tcpinfo
TCP information structure.
Definition: decode.h:173
uint64_t ptime
Packet timestamp in epoch milliseconds.
Definition: decode.h:152
uint8_t frag
Fragmented packet flag.
Definition: decode.h:99
uint16_t vlan_tag
VLAN tag.
Definition: decode.h:118
uint8_t smac[6]
Source MAC address.
Definition: decode.h:112