PcapPlusPlus  20.08+
pcpp::RawPacket Class Reference

#include <RawPacket.h>

Inheritance diagram for pcpp::RawPacket:
pcpp::MBufRawPacket

Public Member Functions

 RawPacket (const uint8_t *pRawData, int rawDataLen, timeval timestamp, bool deleteRawDataAtDestructor, LinkLayerType layerType=LINKTYPE_ETHERNET)
 
 RawPacket (const uint8_t *pRawData, int rawDataLen, timespec timestamp, bool deleteRawDataAtDestructor, LinkLayerType layerType=LINKTYPE_ETHERNET)
 
 RawPacket ()
 
virtual ~RawPacket ()
 
 RawPacket (const RawPacket &other)
 
RawPacketoperator= (const RawPacket &other)
 
virtual uint8_t getObjectType () const
 
virtual bool setRawData (const uint8_t *pRawData, int rawDataLen, timeval timestamp, LinkLayerType layerType=LINKTYPE_ETHERNET, int frameLength=-1)
 
virtual bool setRawData (const uint8_t *pRawData, int rawDataLen, timespec timestamp, LinkLayerType layerType=LINKTYPE_ETHERNET, int frameLength=-1)
 
const uint8_t * getRawData () const
 
LinkLayerType getLinkLayerType () const
 
int getRawDataLen () const
 
int getFrameLength () const
 
timespec getPacketTimeStamp () const
 
virtual bool setPacketTimeStamp (timeval timestamp)
 
virtual bool setPacketTimeStamp (timespec timestamp)
 
bool isPacketSet () const
 
virtual void clear ()
 
virtual void appendData (const uint8_t *dataToAppend, size_t dataToAppendLen)
 
virtual void insertData (int atIndex, const uint8_t *dataToInsert, size_t dataToInsertLen)
 
virtual bool removeData (int atIndex, size_t numOfBytesToRemove)
 
virtual bool reallocateData (size_t newBufferLength)
 

Static Public Member Functions

static bool isLinkTypeValid (int linkTypeValue)
 

Detailed Description

This class holds the packet as raw (not parsed) data. The data is held as byte array. In addition to the data itself every instance also holds a timestamp representing the time the packet was received by the NIC. RawPacket instance isn't read only. The user can change the packet data, add or remove data, etc.

Constructor & Destructor Documentation

◆ RawPacket() [1/4]

pcpp::RawPacket::RawPacket ( const uint8_t *  pRawData,
int  rawDataLen,
timeval  timestamp,
bool  deleteRawDataAtDestructor,
LinkLayerType  layerType = LINKTYPE_ETHERNET 
)

A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.). The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has arrived to the device

Parameters
[in]pRawDataA pointer to the raw data
[in]rawDataLenThe raw data length in bytes
[in]timestampThe timestamp packet was received by the NIC (in usec precision)
[in]deleteRawDataAtDestructorAn indicator whether raw data pointer should be freed when the instance is freed or not. If set to 'true' than pRawData will be freed when instanced is being freed
[in]layerTypeThe link layer type of this raw packet. The default is Ethernet

◆ RawPacket() [2/4]

pcpp::RawPacket::RawPacket ( const uint8_t *  pRawData,
int  rawDataLen,
timespec  timestamp,
bool  deleteRawDataAtDestructor,
LinkLayerType  layerType = LINKTYPE_ETHERNET 
)

A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.). The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has arrived to the device

Parameters
[in]pRawDataA pointer to the raw data
[in]rawDataLenThe raw data length in bytes
[in]timestampThe timestamp packet was received by the NIC (in nsec precision)
[in]deleteRawDataAtDestructorAn indicator whether raw data pointer should be freed when the instance is freed or not. If set to 'true' than pRawData will be freed when instanced is being freed
[in]layerTypeThe link layer type of this raw packet. The default is Ethernet

◆ RawPacket() [3/4]

pcpp::RawPacket::RawPacket ( )

A default constructor that initializes class'es attributes to default value:

  • data pointer is set to NULL
  • data length is set to 0
  • deleteRawDataAtDestructor is set to 'true'

◆ ~RawPacket()

virtual pcpp::RawPacket::~RawPacket ( )
virtual

A destructor for this class. Frees the raw data if deleteRawDataAtDestructor was set to 'true'

◆ RawPacket() [4/4]

pcpp::RawPacket::RawPacket ( const RawPacket other)

A copy constructor that copies all data from another instance. Notice all raw data is copied (using memcpy), so when the original or the other instance are freed, the other won't be affected

Parameters
[in]otherThe instance to copy from

Member Function Documentation

◆ appendData()

virtual void pcpp::RawPacket::appendData ( const uint8_t *  dataToAppend,
size_t  dataToAppendLen 
)
virtual

Append data to the end of current data. This method works without allocating more memory, it just uses memcpy() to copy dataToAppend at the end of the current data. This means that the method assumes this memory was already allocated by the user. If it isn't the case then this method will cause memory corruption

Parameters
[in]dataToAppendA pointer to the data to append to current raw data
[in]dataToAppendLenLength in bytes of dataToAppend

Reimplemented in pcpp::MBufRawPacket.

◆ clear()

virtual void pcpp::RawPacket::clear ( )
virtual

Clears all members of this instance, meaning setting raw data to NULL, raw data length to 0, etc. Currently raw data is always freed, even if deleteRawDataAtDestructor was set to 'false'

Reimplemented in pcpp::MBufRawPacket.

◆ getFrameLength()

int pcpp::RawPacket::getFrameLength ( ) const
inline

Get frame length in bytes

Returns
frame length in bytes

◆ getLinkLayerType()

LinkLayerType pcpp::RawPacket::getLinkLayerType ( ) const
inline

Get the link layer type

Returns
the type of the link layer

◆ getObjectType()

virtual uint8_t pcpp::RawPacket::getObjectType ( ) const
inlinevirtual
Returns
RawPacket object type. Each derived class should return a different value

Reimplemented in pcpp::MBufRawPacket.

◆ getPacketTimeStamp()

timespec pcpp::RawPacket::getPacketTimeStamp ( ) const
inline

Get raw data timestamp

Returns
Raw data timestamp

◆ getRawData()

const uint8_t* pcpp::RawPacket::getRawData ( ) const
inline

Get raw data pointer

Returns
A read-only pointer to the raw data

◆ getRawDataLen()

int pcpp::RawPacket::getRawDataLen ( ) const
inline

Get raw data length in bytes

Returns
Raw data length in bytes

◆ insertData()

virtual void pcpp::RawPacket::insertData ( int  atIndex,
const uint8_t *  dataToInsert,
size_t  dataToInsertLen 
)
virtual

Insert new data at some index of the current data and shift the remaining old data to the end. This method works without allocating more memory, it just copies dataToAppend at the relevant index and shifts the remaining data to the end. This means that the method assumes this memory was already allocated by the user. If it isn't the case then this method will cause memory corruption

Parameters
[in]atIndexThe index to insert the new data to
[in]dataToInsertA pointer to the new data to insert
[in]dataToInsertLenLength in bytes of dataToInsert

Reimplemented in pcpp::MBufRawPacket.

◆ isLinkTypeValid()

static bool pcpp::RawPacket::isLinkTypeValid ( int  linkTypeValue)
static

This static method validates whether a link type integer value is valid

Parameters
[in]linkTypeValueLink type integer value
Returns
True if the link type value is valid and can be casted into LinkLayerType enum, false otherwise

◆ isPacketSet()

bool pcpp::RawPacket::isPacketSet ( ) const
inline

Get an indication whether raw data was already set for this instance.

Returns
True if raw data was set for this instance. Raw data can be set using the non-default constructor, using setRawData(), using the copy constructor or using the assignment operator. Returns false otherwise, for example: if the instance was created using the default constructor or clear() was called

◆ operator=()

RawPacket& pcpp::RawPacket::operator= ( const RawPacket other)

Assignment operator overload for this class. When using this operator on an already initialized RawPacket instance, the original raw data is freed first. Then the other instance is copied to this instance, the same way the copy constructor works

Parameters
[in]otherThe instance to copy from

◆ reallocateData()

virtual bool pcpp::RawPacket::reallocateData ( size_t  newBufferLength)
virtual

Re-allocate raw packet buffer meaning add size to it without losing the current packet data. This method allocates the required buffer size as instructed by the use and then copies the raw data from the current allocated buffer to the new one. This method can become useful if the user wants to insert or append data to the raw data, and the previous allocated buffer is too small, so the user wants to allocate a larger buffer and get RawPacket instance to point to it

Parameters
[in]newBufferLengthThe new buffer length as required by the user. The method is responsible to allocate the memory
Returns
True if data was reallocated successfully, false otherwise

Reimplemented in pcpp::MBufRawPacket.

◆ removeData()

virtual bool pcpp::RawPacket::removeData ( int  atIndex,
size_t  numOfBytesToRemove 
)
virtual

Remove certain number of bytes from current raw data buffer. All data after the removed bytes will be shifted back

Parameters
[in]atIndexThe index to start removing bytes from
[in]numOfBytesToRemoveNumber of bytes to remove
Returns
True if all bytes were removed successfully, or false if atIndex+numOfBytesToRemove is out-of-bounds of the raw data buffer

Reimplemented in pcpp::MBufRawPacket.

◆ setPacketTimeStamp() [1/2]

virtual bool pcpp::RawPacket::setPacketTimeStamp ( timeval  timestamp)
virtual

Set raw packet timestamp with usec precision

Parameters
[in]timestampThe timestamp to set (with usec precision)
Returns
True if timestamp was set successfully, false otherwise

◆ setPacketTimeStamp() [2/2]

virtual bool pcpp::RawPacket::setPacketTimeStamp ( timespec  timestamp)
virtual

Set raw packet timestamp with nsec precision

Parameters
[in]timestampThe timestamp to set (with nsec precision)
Returns
True if timestamp was set successfully, false otherwise

◆ setRawData() [1/2]

virtual bool pcpp::RawPacket::setRawData ( const uint8_t *  pRawData,
int  rawDataLen,
timeval  timestamp,
LinkLayerType  layerType = LINKTYPE_ETHERNET,
int  frameLength = -1 
)
virtual

Set a raw data. If data was already set and deleteRawDataAtDestructor was set to 'true' the old data will be freed first

Parameters
[in]pRawDataA pointer to the new raw data
[in]rawDataLenThe new raw data length in bytes
[in]timestampThe timestamp packet was received by the NIC (in usec precision)
[in]layerTypeThe link layer type for this raw data
[in]frameLengthWhen reading from pcap files, sometimes the captured length is different from the actual packet length. This parameter represents the packet length. This parameter is optional, if not set or set to -1 it is assumed both lengths are equal
Returns
True if raw data was set successfully, false otherwise

◆ setRawData() [2/2]

virtual bool pcpp::RawPacket::setRawData ( const uint8_t *  pRawData,
int  rawDataLen,
timespec  timestamp,
LinkLayerType  layerType = LINKTYPE_ETHERNET,
int  frameLength = -1 
)
virtual

Set a raw data. If data was already set and deleteRawDataAtDestructor was set to 'true' the old data will be freed first

Parameters
[in]pRawDataA pointer to the new raw data
[in]rawDataLenThe new raw data length in bytes
[in]timestampThe timestamp packet was received by the NIC (in nsec precision)
[in]layerTypeThe link layer type for this raw data
[in]frameLengthWhen reading from pcap files, sometimes the captured length is different from the actual packet length. This parameter represents the packet length. This parameter is optional, if not set or set to -1 it is assumed both lengths are equal
Returns
True if raw data was set successfully, false otherwise

Reimplemented in pcpp::MBufRawPacket.