PcapPlusPlus
pcpp::Packet Class Reference

#include <Packet.h>

Public Member Functions

 Packet (size_t maxPacketLen=1)
 
 Packet (RawPacket *rawPacket, bool freeRawPacket=false, ProtocolType parseUntil=UnknownProtocol, OsiModelLayer parseUntilLayer=OsiModelLayerUnknown)
 
 Packet (RawPacket *rawPacket, ProtocolType parseUntil)
 
 Packet (RawPacket *rawPacket, OsiModelLayer parseUntilLayer)
 
virtual ~Packet ()
 
 Packet (const Packet &other)
 
Packetoperator= (const Packet &other)
 
RawPacketgetRawPacket ()
 
void setRawPacket (RawPacket *rawPacket, bool freeRawPacket, ProtocolType parseUntil=UnknownProtocol, OsiModelLayer parseUntilLayer=OsiModelLayerUnknown)
 
RawPacketgetRawPacketReadOnly () const
 
LayergetFirstLayer ()
 
LayergetLastLayer ()
 
bool addLayer (Layer *newLayer)
 
bool insertLayer (Layer *prevLayer, Layer *newLayer)
 
bool removeLayer (Layer *layer)
 
template<class TLayer >
TLayer * getLayerOfType ()
 
template<class TLayer >
TLayer * getNextLayerOfType (Layer *after)
 
bool isPacketOfType (ProtocolType protocolType)
 
void computeCalculateFields ()
 
std::string printToString (bool timeAsLocalTime=true)
 
void printToStringList (std::vector< std::string > &result, bool timeAsLocalTime=true)
 

Detailed Description

This class represents a parsed packet. It contains the raw data (RawPacket instance), and a linked list of layers, each layer is a parsed protocol that this packet contains. The layers linked list is ordered where the first layer is the lowest in the packet (currently it's always Ethernet protocol as PcapPlusPlus supports only Ethernet packets), the next layer will be L2.5 or L3 (e.g VLAN, IPv4, IPv6, etc.), and so on. etc.), etc. The last layer in the linked list will be the highest in the packet. For example: for a standard HTTP request packet the layer will look like this: EthLayer -> IPv4Layer -> TcpLayer -> HttpRequestLayer
Packet instance isn't read only. The user can add or remove layers, update current layer, etc.

Constructor & Destructor Documentation

pcpp::Packet::Packet ( size_t  maxPacketLen = 1)

A constructor for creating a new packet. Very useful when creating packets. When using this constructor an empty raw buffer is allocated (with the size of maxPacketLen) and a new RawPacket is created

Parameters
[in]maxPacketLenThe expected packet length in bytes
pcpp::Packet::Packet ( RawPacket rawPacket,
bool  freeRawPacket = false,
ProtocolType  parseUntil = UnknownProtocol,
OsiModelLayer  parseUntilLayer = OsiModelLayerUnknown 
)

A constructor for creating a packet out of already allocated RawPacket. Very useful when parsing packets that came from the network. When using this constructor a pointer to the RawPacket is saved (data isn't copied) and the RawPacket is parsed, meaning all layers are created and linked to each other in the right order. In this overload of the constructor the user can specify whether to free the instance of raw packet when the Packet is free or not

Parameters
[in]rawPacketA pointer to the raw packet
[in]freeRawPacketOptional parameter. A flag indicating if the destructor should also call the raw packet destructor or not. Default value is false
[in]parseUntilOptional parameter. Parse the packet until you reach a certain protocol (inclusive). Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is UnknownProtocol which means don't take this parameter into account
[in]parseUntilLayerOptional parameter. Parse the packet until you reach a certain layer in the OSI model (inclusive). Can be useful for cases when you need to parse only up to a certain OSI layer (for example transport layer) and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is OsiModelLayerUnknown which means don't take this parameter into account
pcpp::Packet::Packet ( RawPacket rawPacket,
ProtocolType  parseUntil 
)

A constructor for creating a packet out of already allocated RawPacket. Very useful when parsing packets that came from the network. When using this constructor a pointer to the RawPacket is saved (data isn't copied) and the RawPacket is parsed, meaning all layers are created and linked to each other in the right order. In this overload of the constructor the user can specify whether to free the instance of raw packet when the Packet is free or not. This constructor should be used to parse the packet up to a certain layer

Parameters
[in]rawPacketA pointer to the raw packet
[in]parseUntilOptional parameter. Parse the packet until you reach a certain protocol (inclusive). Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet
pcpp::Packet::Packet ( RawPacket rawPacket,
OsiModelLayer  parseUntilLayer 
)

A constructor for creating a packet out of already allocated RawPacket. Very useful when parsing packets that came from the network. When using this constructor a pointer to the RawPacket is saved (data isn't copied) and the RawPacket is parsed, meaning all layers are created and linked to each other in the right order. In this overload of the constructor the user can specify whether to free the instance of raw packet when the Packet is free or not. . This constructor should be used to parse the packet up to a certain layer in the OSI model

Parameters
[in]rawPacketA pointer to the raw packet
[in]parseUntilLayerOptional parameter. Parse the packet until you reach a certain layer in the OSI model (inclusive). Can be useful for cases when you need to parse only up to a certain OSI layer (for example transport layer) and want to avoid the performance impact and memory consumption of parsing the whole packet
virtual pcpp::Packet::~Packet ( )
virtual

A destructor for this class. Frees all layers allocated by this instance (Notice: it doesn't free layers that weren't allocated by this class, for example layers that were added by addLayer() or insertLayer() ). In addition it frees the raw packet if it was allocated by this instance (meaning if it was allocated by this instance constructor)

pcpp::Packet::Packet ( const Packet other)

A copy constructor for this class. This copy constructor copies all the raw data and re-create all layers. So when the original Packet is being freed, no data will be lost in the copied instance

Parameters
[in]otherThe instance to copy from

Member Function Documentation

bool pcpp::Packet::addLayer ( Layer newLayer)

Add a new layer as the last layer in the packet. This method gets a pointer to the new layer as a parameter and attaches it to the packet. Notice after calling this method the input layer is attached to the packet so every change you make in it affect the packet; Also it cannot be attached to other packets

Parameters
[in]newLayerA pointer to the new layer to be added to the packet
Returns
True if everything went well or false otherwise (an appropriate error log message will be printed in such cases)
void pcpp::Packet::computeCalculateFields ( )

Each layer can have fields that can be calculate automatically from other fields using Layer::computeCalculateFields(). This method forces all layers to calculate these fields values

Layer* pcpp::Packet::getFirstLayer ( )
inline

Get a pointer to the first (lowest) layer in the packet

Returns
A pointer to the first (lowest) layer in the packet
Layer* pcpp::Packet::getLastLayer ( )
inline

Get a pointer to the last (highest) layer in the packet

Returns
A pointer to the last (highest) layer in the packet
template<class TLayer >
TLayer * pcpp::Packet::getLayerOfType ( )

A templated method to get a layer of a certain type (protocol). If no layer of such type is found, NULL is returned

Returns
A pointer to the layer of the requested type, NULL if not found
template<class TLayer >
TLayer * pcpp::Packet::getNextLayerOfType ( Layer after)

A templated method to get the first layer of a certain type (protocol), start searching from a certain layer. For example: if a packet looks like: EthLayer -> VlanLayer(1) -> VlanLayer(2) -> VlanLayer(3) -> IPv4Layer and the user put VlanLayer(2) as a parameter and wishes to search for a VlanLayer, VlanLayer(3) will be returned If no layer of such type is found, NULL is returned

Parameters
[in]afterA pointer to the layer to start search from
Returns
A pointer to the layer of the requested type, NULL if not found
RawPacket* pcpp::Packet::getRawPacket ( )
inline

Get a pointer to the Packet's RawPacket

Returns
A pointer to the Packet's RawPacket
RawPacket* pcpp::Packet::getRawPacketReadOnly ( ) const
inline

Get a pointer to the Packet's RawPacket in a read-only manner

Returns
A pointer to the Packet's RawPacket
bool pcpp::Packet::insertLayer ( Layer prevLayer,
Layer newLayer 
)

Insert a new layer after an existing layer in the packet. This method gets a pointer to the new layer as a parameter and attaches it to the packet. Notice after calling this method the input layer is attached to the packet so every change you make in it affect the packet; Also it cannot be attached to other packets

Parameters
[in]prevLayerA pointer to an existing layer in the packet which the new layer should followed by. If this layer isn't attached to a packet and error will be printed to log and false will be returned
[in]newLayerA pointer to the new layer to be added to the packet
Returns
True if everything went well or false otherwise (an appropriate error log message will be printed in such cases)
bool pcpp::Packet::isPacketOfType ( ProtocolType  protocolType)
inline

Check whether the packet contains a certain protocol

Parameters
[in]protocolTypeThe protocol type to search
Returns
True if the packet contains the protocol, false otherwise
Packet& pcpp::Packet::operator= ( const Packet other)

Assignment operator overloading. It first frees all layers allocated by this instance (Notice: it doesn't free layers that weren't allocated by this class, for example layers that were added by addLayer() or insertLayer() ). In addition it frees the raw packet if it was allocated by this instance (meaning if it was allocated by this instance constructor). Afterwards it copies the data from the other packet in the same way used in the copy constructor.

Parameters
[in]otherThe instance to copy from
std::string pcpp::Packet::printToString ( bool  timeAsLocalTime = true)

Each layer can print a string representation of the layer most important data using Layer::toString(). This method aggregates this string from all layers and print it to a complete string containing all packet's relevant data

Parameters
[in]timeAsLocalTimePrint time as local time or GMT. Default (true value) is local time, for GMT set to false
Returns
A string containing most relevant data from all layers (looks like the packet description in Wireshark)
void pcpp::Packet::printToStringList ( std::vector< std::string > &  result,
bool  timeAsLocalTime = true 
)

Similar to printToString(), but instead of one string it outputs a list of strings, one string for every layer

Parameters
[out]resultA string vector that will contain all strings
[in]timeAsLocalTimePrint time as local time or GMT. Default (true value) is local time, for GMT set to false
bool pcpp::Packet::removeLayer ( Layer layer)

Remove an existing layer from the packet

Parameters
[in]layerThe layer to remove
Returns
True if everything went well or false otherwise (an appropriate error log message will be printed in such cases)
void pcpp::Packet::setRawPacket ( RawPacket rawPacket,
bool  freeRawPacket,
ProtocolType  parseUntil = UnknownProtocol,
OsiModelLayer  parseUntilLayer = OsiModelLayerUnknown 
)

Set a RawPacket and re-construct all packet layers

Parameters
[in]rawPacketRaw packet to set
[in]freeRawPacketA flag indicating if the destructor should also call the raw packet destructor or not
[in]parseUntilParse the packet until it reaches this protocol. Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is UnknownProtocol which means don't take this parameter into account
[in]parseUntilLayerParse the packet until certain layer in OSI model. Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is OsiModelLayerUnknown which means don't take this parameter into account