PcapPlusPlus  Next
pcpp::Layer Class Referenceabstract

#include <Layer.h>

Inheritance diagram for pcpp::Layer:
pcpp::IDataContainer pcpp::ArpLayer pcpp::AuthenticationHeaderLayer pcpp::BgpLayer pcpp::CiscoHdlcLayer pcpp::CotpLayer pcpp::DhcpLayer pcpp::DhcpV6Layer pcpp::DnsLayer pcpp::ESPLayer pcpp::EthDot3Layer pcpp::EthLayer pcpp::GreLayer pcpp::GtpV1Layer pcpp::GtpV2Layer pcpp::IPv4Layer pcpp::IPv6Layer pcpp::IcmpLayer pcpp::IcmpV6Layer pcpp::IgmpLayer pcpp::LLCLayer pcpp::LdapLayer pcpp::MplsLayer pcpp::NflogLayer pcpp::NtpLayer pcpp::NullLoopbackLayer pcpp::PPP_PPTPLayer pcpp::PPPoELayer pcpp::PacketTrailerLayer pcpp::PayloadLayer pcpp::RadiusLayer pcpp::S7CommLayer pcpp::SSHLayer pcpp::SSLLayer pcpp::SingleCommandTextProtocol pcpp::Sll2Layer pcpp::SllLayer pcpp::SomeIpLayer pcpp::StpLayer pcpp::TcpLayer pcpp::TelnetLayer pcpp::TextBasedProtocolMessage pcpp::TpktLayer pcpp::UdpLayer pcpp::VlanLayer pcpp::VrrpLayer pcpp::VxlanLayer pcpp::WakeOnLanLayer pcpp::WireGuardLayer

Public Member Functions

 ~Layer () override
 
LayergetNextLayer () const
 
LayergetPrevLayer () const
 
ProtocolType getProtocol () const
 
bool isMemberOfProtocolFamily (ProtocolTypeFamily protocolTypeFamily) const
 
uint8_t * getData () const
 
size_t getDataLen () const
 
uint8_t * getLayerPayload () const
 
size_t getLayerPayloadSize () const
 
bool isAllocatedToPacket () const
 
void copyData (uint8_t *toArr) const
 
uint8_t * getDataPtr (size_t offset=0) const override
 
virtual void parseNextLayer ()=0
 Each layer is responsible for parsing the next layer.
 
virtual size_t getHeaderLen () const =0
 
virtual void computeCalculateFields ()=0
 Each layer can compute field values automatically using this method. This is an abstract method.
 
virtual std::string toString () const =0
 
virtual OsiModelLayer getOsiModelLayer () const =0
 

Protected Member Functions

template<typename T , typename... Args>
LayerconstructNextLayer (uint8_t *data, size_t dataLen, Packet *packet, Args &&... extraArgs)
 
template<typename T , typename TFallback , typename... Args>
LayertryConstructNextLayerWithFallback (uint8_t *data, size_t dataLen, Packet *packet, Args &&... extraArgs)
 

Static Protected Member Functions

template<typename T >
static bool canReinterpretAs (const uint8_t *data, size_t dataLen)
 Check if the data is large enough to reinterpret as a type. More...
 

Detailed Description

Layer is the base class for all protocol layers. Each protocol supported in PcapPlusPlus has a class that inherits Layer. The protocol layer class expose all properties and methods relevant for viewing and editing protocol fields. For example: a pointer to a structured header (e.g tcphdr, iphdr, etc.), protocol header size, payload size, compute fields that can be automatically computed, print protocol data to string, etc. Each protocol instance is obviously part of a protocol stack (which construct a packet). This protocol stack is represented in PcapPlusPlus in a linked list, and each layer is an element in this list. That's why each layer has properties to the next and previous layer in the protocol stack. The Layer class, as a base class, is abstract and the user can't create an instance of it (it has a private constructor). Each layer holds a pointer to the relevant place in the packet. The layer sees all the data from this pointer forward until the end of the packet. Here is an example packet showing this concept:

====================================================
|Eth |IPv4 |TCP |Packet |
|Header |Header |Header |Payload |
====================================================
|--------------------------------------------------|
EthLayer data
|---------------------------------------|
IPv4Layer data
|---------------------------|
TcpLayer data
|----------------|
PayloadLayer data

Constructor & Destructor Documentation

◆ ~Layer()

pcpp::Layer::~Layer ( )
override

A destructor for this class. Frees the data if it was allocated by the layer constructor (see isAllocatedToPacket() for more info)

Member Function Documentation

◆ canReinterpretAs()

template<typename T >
static bool pcpp::Layer::canReinterpretAs ( const uint8_t *  data,
size_t  dataLen 
)
inlinestaticprotected

Check if the data is large enough to reinterpret as a type.

The data must be non-null and at least as large as the type

Template Parameters
TThe type to reinterpret as
Parameters
dataThe data to check
dataLenThe length of the data
Returns
True if the data is large enough to reinterpret as T, false otherwise

◆ constructNextLayer()

template<typename T , typename... Args>
Layer* pcpp::Layer::constructNextLayer ( uint8_t *  data,
size_t  dataLen,
Packet packet,
Args &&...  extraArgs 
)
inlineprotected

Construct the next layer in the protocol stack. No validation is performed on the data.

Template Parameters
TThe type of the layer to construct
ArgsThe types of the arguments to pass to the layer constructor
Parameters
[in]dataThe data to construct the layer from
[in]dataLenThe length of the data
[in]packetThe packet the layer belongs to
[in]extraArgsExtra arguments to be forwarded to the layer constructor
Returns
The constructed layer

◆ copyData()

void pcpp::Layer::copyData ( uint8_t *  toArr) const

Copy the raw data of this layer to another array

Parameters
[out]toArrThe destination byte array

◆ getData()

uint8_t* pcpp::Layer::getData ( ) const
inline
Returns
A pointer to the layer raw data. In most cases it'll be a pointer to the first byte of the header

◆ getDataLen()

size_t pcpp::Layer::getDataLen ( ) const
inline
Returns
The length in bytes of the data from the first byte of the header until the end of the packet

◆ getDataPtr()

uint8_t* pcpp::Layer::getDataPtr ( size_t  offset = 0) const
inlineoverridevirtual

Get a pointer to the data

Parameters
[in]offsetGet a pointer in a certain offset. Default is 0 - get a pointer to start of data
Returns
A pointer to the data

Implements pcpp::IDataContainer.

◆ getHeaderLen()

◆ getLayerPayload()

uint8_t* pcpp::Layer::getLayerPayload ( ) const
inline
Returns
A pointer for the layer payload, meaning the first byte after the header

◆ getLayerPayloadSize()

size_t pcpp::Layer::getLayerPayloadSize ( ) const
inline
Returns
The size in bytes of the payload

◆ getNextLayer()

Layer* pcpp::Layer::getNextLayer ( ) const
inline
Returns
A pointer to the next layer in the protocol stack or nullptr if the layer is the last one

◆ getOsiModelLayer()

◆ getPrevLayer()

Layer* pcpp::Layer::getPrevLayer ( ) const
inline
Returns
A pointer to the previous layer in the protocol stack or nullptr if the layer is the first one

◆ getProtocol()

ProtocolType pcpp::Layer::getProtocol ( ) const
inline
Returns
The protocol enum

◆ isAllocatedToPacket()

bool pcpp::Layer::isAllocatedToPacket ( ) const
inline

Raw data in layers can come from one of sources:

  1. from an existing packet - this is the case when parsing packets received from files or the network. In this case the data was already allocated by someone else, and layer only holds the pointer to the relevant place inside this data
  2. when creating packets, data is allocated when layer is created. In this case the layer is responsible for freeing it as well
Returns
Returns true if the data was allocated by an external source (a packet) or false if it was allocated by the layer itself

◆ isMemberOfProtocolFamily()

bool pcpp::Layer::isMemberOfProtocolFamily ( ProtocolTypeFamily  protocolTypeFamily) const

Check if the layer's protocol matches a protocol family

Parameters
protocolTypeFamilyThe protocol family to check
Returns
True if the layer's protocol matches the protocol family, false otherwise

◆ toString()

virtual std::string pcpp::Layer::toString ( ) const
pure virtual
Returns
A string representation of the layer most important data (should look like the layer description in Wireshark)

Implemented in pcpp::WireGuardLayer, pcpp::WakeOnLanLayer, pcpp::VxlanLayer, pcpp::VrrpLayer, pcpp::VlanLayer, pcpp::UdpLayer, pcpp::TpktLayer, pcpp::TelnetLayer, pcpp::TcpLayer, pcpp::MultipleStpLayer, pcpp::RapidStpLayer, pcpp::StpConfigurationBPDULayer, pcpp::StpTopologyChangeBPDULayer, pcpp::SSLApplicationDataLayer, pcpp::SSLAlertLayer, pcpp::SSLChangeCipherSpecLayer, pcpp::SSLHandshakeLayer, pcpp::SSHEncryptedMessage, pcpp::SSHHandshakeMessage, pcpp::SSHIdentificationMessage, pcpp::SomeIpSdLayer, pcpp::SomeIpTpLayer, pcpp::SomeIpLayer, pcpp::SmtpResponseLayer, pcpp::SmtpRequestLayer, pcpp::SllLayer, pcpp::Sll2Layer, pcpp::SipResponseLayer, pcpp::SipRequestLayer, pcpp::SdpLayer, pcpp::S7CommLayer, pcpp::RadiusLayer, pcpp::PPPoEDiscoveryLayer, pcpp::PPPoESessionLayer, pcpp::PayloadLayer, pcpp::PacketTrailerLayer, pcpp::NullLoopbackLayer, pcpp::NtpLayer, pcpp::NflogLayer, pcpp::NDPNeighborAdvertisementLayer, pcpp::NDPNeighborSolicitationLayer, pcpp::MplsLayer, pcpp::LLCLayer, pcpp::LdapLayer, pcpp::IPv6Layer, pcpp::IPv4Layer, pcpp::ESPLayer, pcpp::AuthenticationHeaderLayer, pcpp::IgmpLayer, pcpp::ICMPv6EchoLayer, pcpp::IcmpV6Layer, pcpp::IcmpLayer, pcpp::HttpResponseLayer, pcpp::HttpRequestLayer, pcpp::GtpV2Layer, pcpp::GtpV1Layer, pcpp::PPP_PPTPLayer, pcpp::GREv1Layer, pcpp::GREv0Layer, pcpp::FtpDataLayer, pcpp::FtpResponseLayer, pcpp::FtpRequestLayer, pcpp::EthLayer, pcpp::EthDot3Layer, pcpp::DnsLayer, pcpp::DhcpV6Layer, pcpp::DhcpLayer, pcpp::CotpLayer, pcpp::CiscoHdlcLayer, pcpp::BgpLayer, and pcpp::ArpLayer.

◆ tryConstructNextLayerWithFallback()

template<typename T , typename TFallback , typename... Args>
Layer* pcpp::Layer::tryConstructNextLayerWithFallback ( uint8_t *  data,
size_t  dataLen,
Packet packet,
Args &&...  extraArgs 
)
inlineprotected

Try to construct the next layer in the protocol stack with a fallback option.

The method checks if the data is valid for the layer type T before constructing it by calling T::isDataValid(data, dataLen). If the data is invalid, it constructs the layer of type TFallback.

Template Parameters
TThe type of the layer to construct
TFallbackThe fallback layer type to construct if T fails
ArgsThe types of the extra arguments to pass to the layer constructor of T
Parameters
[in]dataThe data to construct the layer from
[in]dataLenThe length of the data
[in]packetThe packet the layer belongs to
[in]extraArgsExtra arguments to be forwarded to the layer constructor of T
Returns
The constructed layer of type T or TFallback