PcapPlusPlus
pcpp::RawPacket Class Reference

#include <RawPacket.h>

Inheritance diagram for pcpp::RawPacket:
pcpp::MBufRawPacket

Public Member Functions

 RawPacket (const uint8_t *pRawData, int rawDataLen, timeval timestamp, bool deleteRawDataAtDestructor, LinkLayerType layerType=LINKTYPE_ETHERNET)
 
 RawPacket ()
 
virtual ~RawPacket ()
 
 RawPacket (const RawPacket &other)
 
RawPacketoperator= (const RawPacket &other)
 
virtual bool setRawData (const uint8_t *pRawData, int rawDataLen, timeval timestamp, LinkLayerType layerType=LINKTYPE_ETHERNET, int frameLength=-1)
 
const uint8_t * getRawData ()
 
const uint8_t * getRawDataReadOnly () const
 
LinkLayerType getLinkLayerType () const
 
int getRawDataLen () const
 
int getFrameLength () const
 
timeval getPacketTimeStamp ()
 
bool isPacketSet ()
 
virtual void clear ()
 
virtual void appendData (const uint8_t *dataToAppend, size_t dataToAppendLen)
 
virtual void insertData (int atIndex, const uint8_t *dataToInsert, size_t dataToInsertLen)
 
virtual bool removeData (int atIndex, size_t numOfBytesToRemove)
 
virtual bool reallocateData (size_t newBufferLength)
 

Detailed Description

This class holds the packet as raw (not parsed) data. The data is held as byte array. In addition to the data itself every instance also holds a timestamp representing the time the packet was received by the NIC. RawPacket instance isn't read only. The user can change the packet data, add or remove data, etc.

Constructor & Destructor Documentation

pcpp::RawPacket::RawPacket ( const uint8_t *  pRawData,
int  rawDataLen,
timeval  timestamp,
bool  deleteRawDataAtDestructor,
LinkLayerType  layerType = LINKTYPE_ETHERNET 
)

A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually used when packet is captured using a packet capturing engine (like libPcap. WinPcap, PF_RING, etc.). The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has arrived to the device

Parameters
[in]pRawDataA pointer to the raw data
[in]rawDataLenThe raw data length in bytes
[in]timestampThe timestamp packet was received by the NIC
[in]deleteRawDataAtDestructorAn indicator whether raw data pointer should be freed when the instance is freed or not. If set to 'true' than pRawData will be freed when instanced is being freed
[in]layerTypeThe link layer type of this raw packet. The default is Ethernet
pcpp::RawPacket::RawPacket ( )

A default constructor that initializes class'es attributes to default value:

  • data pointer is set to NULL
  • data length is set to 0
  • deleteRawDataAtDestructor is set to 'true'
    Todo:
    timestamp isn't set here to a default value
virtual pcpp::RawPacket::~RawPacket ( )
virtual

A destructor for this class. Frees the raw data if deleteRawDataAtDestructor was set to 'true'

pcpp::RawPacket::RawPacket ( const RawPacket other)

A copy constructor that copies all data from another instance. Notice all raw data is copied (using memcpy), so when the original or the other instance are freed, the other won't be affected

Parameters
[in]otherThe instance to copy from

Member Function Documentation

virtual void pcpp::RawPacket::appendData ( const uint8_t *  dataToAppend,
size_t  dataToAppendLen 
)
virtual

Append data to the end of current data. This method works without allocating more memory, it just uses memcpy() to copy dataToAppend at the end of the current data. This means that the method assumes this memory was already allocated by the user. If it isn't the case then this method will cause memory corruption

Parameters
[in]dataToAppendA pointer to the data to append to current raw data
[in]dataToAppendLenLength in bytes of dataToAppend

Reimplemented in pcpp::MBufRawPacket.

virtual void pcpp::RawPacket::clear ( )
virtual

Clears all members of this instance, meaning setting raw data to NULL, raw data length to 0, etc. Currently raw data is always freed, even if deleteRawDataAtDestructor was set to 'false'

Todo:

deleteRawDataAtDestructor was set to 'true', don't free the raw data

set timestamp to a default value as well

Reimplemented in pcpp::MBufRawPacket.

int pcpp::RawPacket::getFrameLength ( ) const

Get frame length in bytes

Returns
frame length in bytes
LinkLayerType pcpp::RawPacket::getLinkLayerType ( ) const

Get the link layer tpye

Returns
the type of the link layer
timeval pcpp::RawPacket::getPacketTimeStamp ( )

Get raw data timestamp

Returns
Raw data timestamp
const uint8_t* pcpp::RawPacket::getRawData ( )

Get raw data pointer

Returns
A pointer to the raw data
int pcpp::RawPacket::getRawDataLen ( ) const

Get raw data length in bytes

Returns
Raw data length in bytes
const uint8_t* pcpp::RawPacket::getRawDataReadOnly ( ) const

Get read only raw data pointer

Returns
A read-only pointer to the raw data
virtual void pcpp::RawPacket::insertData ( int  atIndex,
const uint8_t *  dataToInsert,
size_t  dataToInsertLen 
)
virtual

Insert new data at some index of the current data and shift the remaining old data to the end. This method works without allocating more memory, it just copies dataToAppend at the relevant index and shifts the remaining data to the end. This means that the method assumes this memory was already allocated by the user. If it isn't the case then this method will cause memory corruption

Parameters
[in]atIndexThe index to insert the new data to
[in]dataToInsertA pointer to the new data to insert
[in]dataToInsertLenLength in bytes of dataToInsert

Reimplemented in pcpp::MBufRawPacket.

bool pcpp::RawPacket::isPacketSet ( )
inline

Get an indication whether raw data was already set for this instance.

Returns
True if raw data was set for this instance. Raw data can be set using the non-default constructor, using setRawData(), using the copy constructor or using the assignment operator. Returns false otherwise, for example: if the instance was created using the default constructor or clear() was called
RawPacket& pcpp::RawPacket::operator= ( const RawPacket other)

Assignment operator overload for this class. When using this operator on an already initialized RawPacket instance, the original raw data is freed first. Then the other instance is copied to this instance, the same way the copy constructor works

Todo:
free raw data only if deleteRawDataAtDestructor was set to 'true'
Parameters
[in]otherThe instance to copy from
virtual bool pcpp::RawPacket::reallocateData ( size_t  newBufferLength)
virtual

Re-allocate raw packet buffer meaning add size to it without losing the current packet data. This method allocates the required buffer size as instructed by the use and then copies the raw data from the current allocated buffer to the new one. This method can become useful if the user wants to insert or append data to the raw data, and the previous allocated buffer is too small, so the user wants to allocate a larger buffer and get RawPacket instance to point to it

Parameters
[in]newBufferLengthThe new buffer length as required by the user. The method is responsible to allocate the memory
Returns
True if data was reallocated successfully, false otherwise

Reimplemented in pcpp::MBufRawPacket.

virtual bool pcpp::RawPacket::removeData ( int  atIndex,
size_t  numOfBytesToRemove 
)
virtual

Remove certain number of bytes from current raw data buffer. All data after the removed bytes will be shifted back

Parameters
[in]atIndexThe index to start removing bytes from
[in]numOfBytesToRemoveNumber of bytes to remove
Returns
True if all bytes were removed successfully, or false if atIndex+numOfBytesToRemove is out-of-bounds of the raw data buffer

Reimplemented in pcpp::MBufRawPacket.

virtual bool pcpp::RawPacket::setRawData ( const uint8_t *  pRawData,
int  rawDataLen,
timeval  timestamp,
LinkLayerType  layerType = LINKTYPE_ETHERNET,
int  frameLength = -1 
)
virtual

Set a raw data. If data was already set and deleteRawDataAtDestructor was set to 'true' the old data will be freed first

Parameters
[in]pRawDataA pointer to the new raw data
[in]rawDataLenThe new raw data length in bytes
[in]timestampThe timestamp packet was received by the NIC
[in]layerTypeThe link layer type for this raw data
[in]frameLengthWhen reading from pcap files, sometimes the captured length is different from the actual packet length. This parameter represents the packet length. This parameter is optional, if not set or set to -1 it is assumed both lengths are equal
Returns
True if raw data was set successfully, false otherwise