The PktInfo class is meant to be easier to use than individually calling the L2 and L3 helper functions. More...

#include "PktInfo.hpp"

Collaboration diagram for Myra::PktInfo:

Public Member Functions
	~PktInfo (void)
	Destructor. More...

PktInfo &	clear (void)
	Reset all of the information we've analyzed, preparing this object to be re-used. More...

bool	empty (void) const
	Determine if the PktInfo object has been cleared. More...

PktInfo &	initialize (const uint8_t *raw_packet_buffer, const std::size_t new_len, const L2::Ethertype start_type=L2::Ethertype::Unknown)
	Perform the analysis on the given raw packet buffer. More...

bool	is_initialized (void) const
	Quickly determine whether the PktInfo object has been initialized. More...

std::string	type (void) const
	Generate a 1- or 2-word description for this packet. More...

std::string	debug_info (void) const
	Generate a few lines of text describing the packet. For debug purposes only. More...

uint16_t	get_l4_payload_len (void) const
	Get the L4 payload length. More...


	PktInfo (void)
	Constructor. More...

	PktInfo (const uint8_t *raw, const std::size_t new_len, const L2::Ethertype start_type=L2::Ethertype::Unknown)
	Constructor. More...


bool	is_l2 (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_arp (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_ipv4 (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_ipv6 (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_ip (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_tcp (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_udp (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_icmp (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...

bool	is_icmpv6 (void) const
	Simple and quick inline method to determine the existence of packet header pointer. More...


const PktInfo &	get_tuple (Myra::AddrPort &a_p_1, Myra::AddrPort &a_p_2) const
	Extract the tuples from this packet. More...

const PktInfo &	get_tuple (Myra::FlowTuple &tuple) const
	Extract the tuples from this packet. More...

Myra::FlowTuple	get_tuple (void) const
	Extract the tuples from this packet. More...


const uint8_t *	get_l4_payload (void) const
	Get the L4 payload (could be TCP, UDP, or ICMP). More...

const char *	get_l4_payload_data (void) const
	Get the L4 payload (could be TCP, UDP, or ICMP). More...

Public Attributes
bool	initialized
	Whether the packet information was initialized. More...

const uint8_t *	raw
	Raw packet data. More...

std::size_t	len
	Raw packet length. More...

const L2::Header *	l2
	Pointer to L2 header. Will be `nullptr` if the packet was obtained through netfilter queue. More...

L2::Ethertype	l2_ethertype
	Ethertype describes the L3 header. More...

const L3_ARP::Header *	l3_arp
	L3 is ARP. This pointer will be `nullptr` when the packet is not ARP. More...

const L3_IPv4::Header *	l3_ipv4
	L3 is IPv4. This pointer will be `nullptr` when the packet is not IPv4. More...

const L3_IPv6::Header *	l3_ipv6
	L3 is IPv6. This pointer will be `nullptr` when the packet is not IPv6. More...

L3_IP::Protocol	l3_protocol
	Protocol describes the L4 header (if any). More...

const L4_TCP::Header *	l4_tcp
	L4 is TCP. This pointer will be `nullptr` when the packet is not TCP. More...

const L4_UDP::Header *	l4_udp
	L4 is UDP. This pointer will be `nullptr` when the packet is not UDP. More...

const L4_ICMP::Header *	l4_icmp
	L4 is ICMP. This pointer will be `nullptr` when the packet is not ICMP. More...

const L4_ICMPv6::Header *	l4_icmpv6
	L4 is ICMPv6. This pointer will be `nullptr` when the packet is not IPv6. More...

std::size_t	stats_index
	Index (incoming versus outgoing) describing how this packet needs to be recorded in the database. More...

Detailed Description

The PktInfo class is meant to be easier to use than individually calling the L2 and L3 helper functions.

It is also meant to be a very quick peek into L2, L3, and L4 of a single packet. It does not perform the functionality of the traffic and flow analysis! Identification of a flow from an individual packet (meaning generating the flow hash using Myra::hash()) requires at a bare minimum some of the L2-L4 fields from this quick look into the packet internals.

See also: Myra::Flow

Constructor & Destructor Documentation

Myra::PktInfo::~PktInfo ( void )

Destructor.

Myra::PktInfo::PktInfo ( void )

Constructor.

Myra::PktInfo::PktInfo	(	const uint8_t *	raw,
		const std::size_t	new_len,
		const L2::Ethertype	start_type = `L2::Ethertype::Unknown`
	)

Constructor.

Member Function Documentation

Myra::PktInfo & Myra::PktInfo::clear ( void )

Reset all of the information we've analyzed, preparing this object to be re-used.

See also: initialize()

Calling this method will set the initialized field to false.

std::string Myra::PktInfo::debug_info ( void ) const

Generate a few lines of text describing the packet. For debug purposes only.

Here is the call graph for this function:

Here is the caller graph for this function:

bool Myra::PktInfo::empty ( void ) const

inline

Determine if the PktInfo object has been cleared.

Here is the call graph for this function:

Here is the caller graph for this function:

const uint8_t * Myra::PktInfo::get_l4_payload ( void ) const

Get the L4 payload (could be TCP, UDP, or ICMP).

Here is the call graph for this function:

Here is the caller graph for this function:

const char* Myra::PktInfo::get_l4_payload_data ( void ) const

inline

Get the L4 payload (could be TCP, UDP, or ICMP).

Here is the call graph for this function:

Here is the caller graph for this function:

uint16_t Myra::PktInfo::get_l4_payload_len ( void ) const

Get the L4 payload length.

See also: get_l4_payload().

Here is the call graph for this function:

Here is the caller graph for this function:

const Myra::PktInfo & Myra::PktInfo::get_tuple	(	Myra::AddrPort &	a_p_1,
		Myra::AddrPort &	a_p_2
	)		const

Extract the tuples from this packet.

Here is the call graph for this function:

Here is the caller graph for this function:

const Myra::PktInfo & Myra::PktInfo::get_tuple ( Myra::FlowTuple & tuple ) const

Extract the tuples from this packet.

Myra::FlowTuple Myra::PktInfo::get_tuple ( void ) const

Extract the tuples from this packet.

Myra::PktInfo & Myra::PktInfo::initialize	(	const uint8_t *	raw_packet_buffer,
		const std::size_t	new_len,
		const L2::Ethertype	start_type = `L2::Ethertype::Unknown`
	)

Perform the analysis on the given raw packet buffer.

Calling this method with either nullptr or a length of zero is the equivalent of calling clear().

Exceptions

std::invalid_argument if the size is too small to at least represent a L2 header.

Todo:: fix this code to use Myra::ipv4_from_string() instead of inet_aton()

Here is the call graph for this function:

Here is the caller graph for this function:

bool Myra::PktInfo::is_arp ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the caller graph for this function:

bool Myra::PktInfo::is_icmp ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the caller graph for this function:

bool Myra::PktInfo::is_icmpv6 ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

bool Myra::PktInfo::is_initialized ( void ) const

inline

Quickly determine whether the PktInfo object has been initialized.

See also: Myra::PktInfo::initialize()

Here is the caller graph for this function:

bool Myra::PktInfo::is_ip ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the call graph for this function:

bool Myra::PktInfo::is_ipv4 ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the caller graph for this function:

bool Myra::PktInfo::is_ipv6 ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the caller graph for this function:

bool Myra::PktInfo::is_l2 ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the caller graph for this function:

bool Myra::PktInfo::is_tcp ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the caller graph for this function:

bool Myra::PktInfo::is_udp ( void ) const

inline

Simple and quick inline method to determine the existence of packet header pointer.

Here is the caller graph for this function:

std::string Myra::PktInfo::type ( void ) const

Generate a 1- or 2-word description for this packet.

Uses l2_ethertype and l3_protocol to generate the name. For example, may return IPv4+TCP or IPv6+ICMPv6.

Examples of packet types returned by this method:

"IPv6+UDP"
"IPv4+TCP"
"ARP"
"unknown

Here is the call graph for this function:

Member Data Documentation

bool Myra::PktInfo::initialized

Whether the packet information was initialized.

See also: initialize(); is_initialized()

const L2::Header* Myra::PktInfo::l2

Pointer to L2 header. Will be nullptr if the packet was obtained through netfilter queue.

L2::Ethertype Myra::PktInfo::l2_ethertype

Ethertype describes the L3 header.

const L3_ARP::Header* Myra::PktInfo::l3_arp

L3 is ARP. This pointer will be nullptr when the packet is not ARP.

See also: is_arp()

const L3_IPv4::Header* Myra::PktInfo::l3_ipv4

L3 is IPv4. This pointer will be nullptr when the packet is not IPv4.

See also: is_ipv4()

const L3_IPv6::Header* Myra::PktInfo::l3_ipv6

L3 is IPv6. This pointer will be nullptr when the packet is not IPv6.

See also: is_ipv6()

L3_IP::Protocol Myra::PktInfo::l3_protocol

Protocol describes the L4 header (if any).

const L4_ICMP::Header* Myra::PktInfo::l4_icmp

L4 is ICMP. This pointer will be nullptr when the packet is not ICMP.

See also: is_icmp()

const L4_ICMPv6::Header* Myra::PktInfo::l4_icmpv6

L4 is ICMPv6. This pointer will be nullptr when the packet is not IPv6.

See also: is_icmpv6()

const L4_TCP::Header* Myra::PktInfo::l4_tcp

L4 is TCP. This pointer will be nullptr when the packet is not TCP.

See also: is_tcp()

const L4_UDP::Header* Myra::PktInfo::l4_udp

L4 is UDP. This pointer will be nullptr when the packet is not UDP.

See also: is_udp()

std::size_t Myra::PktInfo::len

Raw packet length.

const uint8_t* Myra::PktInfo::raw

Raw packet data.

std::size_t Myra::PktInfo::stats_index

Index (incoming versus outgoing) describing how this packet needs to be recorded in the database.

Is set to 0 for outgoing packets.
Is set to 1 for incoming packets.

The documentation for this class was generated from the following files:

Myra/src-network/PktInfo.hpp
Myra/src-network/PktInfo.cpp

Public Member Functions

Public Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation