packet_endpoints.h File Reference

#include <wireshark.h>
#include <wsutil/process_lookup.h>

Go to the source code of this file.

Classes
struct	ws_packet_endpoints

Typedefs
typedef struct ws_packet_endpoints	ws_packet_endpoints_t

Functions
WS_DLL_PUBLIC bool	ws_packet_endpoints_linktype_supported (int linktype)
	Whether packets with a link-layer header type can be parsed.
WS_DLL_PUBLIC bool	ws_packet_endpoints_parse (int linktype, const uint8_t *data, size_t len, ws_packet_endpoints_t *endpoints)
	Find the endpoints of a TCP or UDP packet.

Detailed Description

Find the transport endpoints of a raw packet: the IP addresses, transport protocol and ports of a TCP or UDP packet, given the link-layer header type it was captured with.

Wireshark - Network traffic analyzer By Gerald Combs geral.nosp@m.d@wi.nosp@m.resha.nosp@m.rk.o.nosp@m.rg Copyright 1998 Gerald Combs

SPDX-License-Identifier: GPL-2.0-or-later

Typedef Documentation

ws_packet_endpoints_t

typedef struct ws_packet_endpoints ws_packet_endpoints_t

The transport endpoints of a packet.

Function Documentation

ws_packet_endpoints_linktype_supported()

WS_DLL_PUBLIC bool ws_packet_endpoints_linktype_supported

(

int

linktype

)

Whether packets with a link-layer header type can be parsed.

Parameters

linktype

The LINKTYPE_ value, as in a pcapng Interface Description Block or a pcap file header.

Returns

true for Ethernet, the BSD loopback encapsulations, Linux cooked capture v1 and v2, and raw IPv4 or IPv6.

ws_packet_endpoints_parse()

WS_DLL_PUBLIC bool ws_packet_endpoints_parse	(	int	linktype,
		const uint8_t *	data,
		size_t	len,
		ws_packet_endpoints_t *	endpoints )

Find the endpoints of a TCP or UDP packet.

Handles Ethernet, with any 802.1Q or 802.1ad VLAN tags, the BSD loopback encapsulations (LINKTYPE_NULL and LINKTYPE_LOOP), Linux cooked capture v1 and v2, and raw IPv4 or IPv6, followed by an IPv4 header, or an IPv6 header with any hop-by-hop, routing, destination options, fragment and authentication headers, and then a TCP or UDP header.

Parameters

linktype	The LINKTYPE_ value of the packet.
data	The packet data.
len	The number of bytes of packet data captured.
endpoints	Filled in on success.

Returns

true if the packet is a TCP or UDP packet whose ports are present, i.e. it is not a later fragment and was not cut off before the ports.