pcpp::Layer Class Reference

#include <Layer.h>

Inheritance diagram for pcpp::Layer:

Public Member Functions
	~Layer () override
Layer *	getNextLayer () const
Layer *	getPrevLayer () const
ProtocolType	getProtocol () const
bool	isMemberOfProtocolFamily (ProtocolTypeFamily protocolTypeFamily) const
uint8_t *	getData () const
size_t	getDataLen () const
uint8_t *	getLayerPayload () const
size_t	getLayerPayloadSize () const
bool	isAllocatedToPacket () const
void	copyData (uint8_t *toArr) const
uint8_t *	getDataPtr (size_t offset=0) const override
virtual void	parseNextLayer ()=0
	Each layer is responsible for parsing the next layer.
virtual size_t	getHeaderLen () const =0
virtual void	computeCalculateFields ()=0
	Each layer can compute field values automatically using this method. This is an abstract method.
virtual std::string	toString () const =0
virtual OsiModelLayer	getOsiModelLayer () const =0

Protected Member Functions
Packet *	getAttachedPacket ()
	Get a pointer to the Packet this layer is attached to (if any). More...
Packet const *	getAttachedPacket () const
	Get a pointer to the Packet this layer is attached to (if any). More...
template<typename T , typename... Args>
Layer *	constructNextLayer (uint8_t *data, size_t dataLen, Args &&... extraArgs)
	Construct the next layer in the protocol stack. No validation is performed on the data. More...
template<typename T , typename... Args>
Layer *	constructNextLayer (uint8_t *data, size_t dataLen, Packet *packet, Args &&... extraArgs)
template<typename TFactory , typename... Args>
Layer *	constructNextLayerFromFactory (TFactory factoryFn, uint8_t *data, size_t dataLen, Args &&... extraArgs)
	Construct the next layer in the protocol stack using a factory functor. More...
template<typename TFactory , typename... Args>
Layer *	constructNextLayerFromFactory (TFactory factoryFn, uint8_t *data, size_t dataLen, Packet *packet, Args &&... extraArgs)
	Construct the next layer in the protocol stack using a factory functor. More...
template<typename T , typename... Args>
Layer *	tryConstructNextLayer (uint8_t *data, size_t dataLen, Args &&... extraArgs)
template<typename T , typename... Args>
Layer *	tryConstructNextLayer (uint8_t *data, size_t dataLen, Packet *packet, Args &&... extraArgs)
template<typename T , typename TFallback , typename... Args>
Layer *	tryConstructNextLayerWithFallback (uint8_t *data, size_t dataLen, Args &&... extraArgs)
	Try to construct the next layer in the protocol stack with a fallback option. More...
template<typename T , typename TFallback , typename... Args>
Layer *	tryConstructNextLayerWithFallback (uint8_t *data, size_t dataLen, Packet *packet, Args &&... extraArgs)
template<typename TFallback , typename TFactory , typename... Args>
Layer *	tryConstructNextLayerFromFactoryWithFallback (TFactory factoryFn, uint8_t *data, size_t dataLen, Args &&... extraArgs)
	Try to construct the next layer in the protocol stack using a factory functor with a fallback option. More...
template<typename TFallback , typename TFactory , typename... Args>
Layer *	tryConstructNextLayerFromFactoryWithFallback (TFactory factoryFn, uint8_t *data, size_t dataLen, Packet *packet, Args &&... extraArgs)
	Try to construct the next layer in the protocol stack using a factory functor with a fallback option. More...

Static Protected Member Functions
template<typename T >
static bool	canReinterpretAs (const uint8_t *data, size_t dataLen)
	Check if the data is large enough to reinterpret as a type. More...

Detailed Description

Layer is the base class for all protocol layers. Each protocol supported in PcapPlusPlus has a class that inherits Layer. The protocol layer class expose all properties and methods relevant for viewing and editing protocol fields. For example: a pointer to a structured header (e.g tcphdr, iphdr, etc.), protocol header size, payload size, compute fields that can be automatically computed, print protocol data to string, etc. Each protocol instance is obviously part of a protocol stack (which construct a packet). This protocol stack is represented in PcapPlusPlus in a linked list, and each layer is an element in this list. That's why each layer has properties to the next and previous layer in the protocol stack. The Layer class, as a base class, is abstract and the user can't create an instance of it (it has a private constructor). Each layer holds a pointer to the relevant place in the packet. The layer sees all the data from this pointer forward until the end of the packet. Here is an example packet showing this concept:

====================================================
|Eth       |IPv4       |TCP       |Packet          |
|Header    |Header     |Header    |Payload         |
====================================================
 
|--------------------------------------------------|
EthLayer data
           |---------------------------------------|
           IPv4Layer data
                       |---------------------------|
                       TcpLayer data
                                  |----------------|
                                  PayloadLayer data

Constructor & Destructor Documentation

~Layer()

pcpp::Layer::~Layer ( )

override

A destructor for this class. Frees the data if it was allocated by the layer constructor (see isAllocatedToPacket() for more info)

Member Function Documentation

canReinterpretAs()

template<typename T >

static bool pcpp::Layer::canReinterpretAs ( const uint8_t *  data, size_t  dataLen  )

inlinestaticprotected

Check if the data is large enough to reinterpret as a type.

The data must be non-null and at least as large as the type

Template Parameters

T	The type to reinterpret as

Parameters

data	The data to check
dataLen	The length of the data

Returns

True if the data is large enough to reinterpret as T, false otherwise

constructNextLayer() [1/2]

template<typename T , typename... Args>

Layer* pcpp::Layer::constructNextLayer ( uint8_t *  data, size_t  dataLen, Args &&...  extraArgs  )

inlineprotected

Construct the next layer in the protocol stack. No validation is performed on the data.

This overload infers the Packet from the current layer.

Template Parameters

T	The type of the layer to construct
Args	The types of the arguments to pass to the layer constructor

Parameters

data	The data to construct the layer from
dataLen	The length of the data
extraArgs	Extra arguments to be forwarded to the layer constructor

Returns

The constructed layer

constructNextLayer() [2/2]

template<typename T , typename... Args>

Layer* pcpp::Layer::constructNextLayer ( uint8_t *  data, size_t  dataLen, Packet *  packet, Args &&...  extraArgs  )

inlineprotected

Construct the next layer in the protocol stack. No validation is performed on the data.

Template Parameters

T	The type of the layer to construct
Args	The types of the arguments to pass to the layer constructor

Parameters

[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	packet	The packet the layer belongs to
[in]	extraArgs	Extra arguments to be forwarded to the layer constructor

Returns

The constructed layer

constructNextLayerFromFactory() [1/2]

template<typename TFactory , typename... Args>

Layer* pcpp::Layer::constructNextLayerFromFactory ( TFactory  factoryFn, uint8_t *  data, size_t  dataLen, Args &&...  extraArgs  )

inlineprotected

Construct the next layer in the protocol stack using a factory functor.

No validation is performed on the data, outside of what the factory functor may perform. If the factory returns a nullptr, no next layer is set.

The factory functor is expected to have the following signature: Layer* factoryFn(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet, ...);

This overload infers the Packet from the current layer.

Template Parameters

TFactory	The factory functor type.
...Args	Parameter pack for extra arguments to pass to the factory functor.

Parameters

[in]	factoryFn	The factory functor to create the layer.
[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	extraArgs	Extra arguments to be forwarded to the factory.

Returns

The return value of the factory functor.

constructNextLayerFromFactory() [2/2]

template<typename TFactory , typename... Args>

Layer* pcpp::Layer::constructNextLayerFromFactory ( TFactory  factoryFn, uint8_t *  data, size_t  dataLen, Packet *  packet, Args &&...  extraArgs  )

inlineprotected

Construct the next layer in the protocol stack using a factory functor.

No validation is performed on the data, outside of what the factory functor may perform. If the factory returns a nullptr, no next layer is set.

The factory functor is expected to have the following signature: Layer* factoryFn(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet, ...);

Template Parameters

TFactory	The factory functor type.
...Args	Parameter pack for extra arguments to pass to the factory functor.

Parameters

[in]	factoryFn	The factory functor to create the layer.
[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	packet	The packet the layer belongs to
[in]	extraArgs	Extra arguments to be forwarded to the factory.

Returns

The return value of the factory functor.

copyData()

void pcpp::Layer::copyData

(

uint8_t *

toArr

)

const

Copy the raw data of this layer to another array

Parameters

[out]

toArr

The destination byte array

getAttachedPacket() [1/2]

Packet* pcpp::Layer::getAttachedPacket ( )

inlineprotected

Get a pointer to the Packet this layer is attached to (if any).

Returns

A pointer to the Packet this layer is attached to, or nullptr if the layer is not attached.

getAttachedPacket() [2/2]

Packet const* pcpp::Layer::getAttachedPacket ( ) const

inlineprotected

Get a pointer to the Packet this layer is attached to (if any).

Returns

A const pointer to the Packet this layer is attached to, or nullptr if the layer is not attached.

getData()

uint8_t* pcpp::Layer::getData ( ) const

inline

Returns

A pointer to the layer raw data. In most cases it'll be a pointer to the first byte of the header

getDataLen()

size_t pcpp::Layer::getDataLen ( ) const

inline

Returns

The length in bytes of the data from the first byte of the header until the end of the packet

getDataPtr()

uint8_t* pcpp::Layer::getDataPtr ( size_t  offset = 0 ) const

inlineoverridevirtual

Get a pointer to the data

Parameters

[in]

offset

Get a pointer in a certain offset. Default is 0 - get a pointer to start of data

Returns

A pointer to the data

Implements pcpp::IDataContainer.

getHeaderLen()

virtual size_t pcpp::Layer::getHeaderLen ( ) const

pure virtual

Returns

The header length in bytes

Implemented in pcpp::WireGuardLayer, pcpp::WakeOnLanLayer, pcpp::VxlanLayer, pcpp::VrrpLayer, pcpp::VlanLayer, pcpp::UdpLayer, pcpp::TpktLayer, pcpp::TextBasedProtocolMessage, pcpp::TelnetLayer, pcpp::TcpLayer, pcpp::RapidStpLayer, pcpp::StpConfigurationBPDULayer, pcpp::StpTopologyChangeBPDULayer, pcpp::StpLayer, pcpp::SSLLayer, pcpp::SSHEncryptedMessage, pcpp::SSHHandshakeMessage, pcpp::SSHIdentificationMessage, pcpp::SomeIpLayer, pcpp::SmtpLayer, pcpp::SllLayer, pcpp::Sll2Layer, pcpp::S7CommLayer, pcpp::RadiusLayer, pcpp::PPPoEDiscoveryLayer, pcpp::PPPoESessionLayer, pcpp::PayloadLayer, pcpp::PacketTrailerLayer, pcpp::NullLoopbackLayer, pcpp::NtpLayer, pcpp::NflogLayer, pcpp::MplsLayer, pcpp::ModbusLayer, pcpp::LLCLayer, pcpp::LdapLayer, pcpp::IPv6Layer, pcpp::IPv4Layer, pcpp::ESPLayer, pcpp::AuthenticationHeaderLayer, pcpp::IgmpV3ReportLayer, pcpp::IgmpV3QueryLayer, pcpp::IgmpLayer, pcpp::IcmpV6Layer, pcpp::IcmpLayer, pcpp::GtpV2Layer, pcpp::GtpV1Layer, pcpp::PPP_PPTPLayer, pcpp::GreLayer, pcpp::FtpLayer, pcpp::EthLayer, pcpp::EthDot3Layer, pcpp::DoIpDiagnosticMessage, pcpp::DoIpLayer, pcpp::DnsLayer, pcpp::DhcpV6Layer, pcpp::DhcpLayer, pcpp::CotpLayer, pcpp::CiscoHdlcLayer, pcpp::BgpLayer, and pcpp::ArpLayer.

getLayerPayload()

uint8_t* pcpp::Layer::getLayerPayload ( ) const

inline

Returns

A pointer for the layer payload, meaning the first byte after the header

getLayerPayloadSize()

size_t pcpp::Layer::getLayerPayloadSize ( ) const

inline

Returns

The size in bytes of the payload

getNextLayer()

Layer* pcpp::Layer::getNextLayer ( ) const

inline

Returns

A pointer to the next layer in the protocol stack or nullptr if the layer is the last one

getOsiModelLayer()

virtual OsiModelLayer pcpp::Layer::getOsiModelLayer ( ) const

pure virtual

Returns

The OSI Model layer this protocol belongs to

Implemented in pcpp::WireGuardLayer, pcpp::WakeOnLanLayer, pcpp::VxlanLayer, pcpp::VrrpLayer, pcpp::VlanLayer, pcpp::UdpLayer, pcpp::TpktLayer, pcpp::TelnetLayer, pcpp::TcpLayer, pcpp::StpLayer, pcpp::SSLLayer, pcpp::SSHLayer, pcpp::SomeIpLayer, pcpp::SmtpLayer, pcpp::SllLayer, pcpp::Sll2Layer, pcpp::SipLayer, pcpp::SdpLayer, pcpp::S7CommLayer, pcpp::RadiusLayer, pcpp::PPPoELayer, pcpp::PayloadLayer, pcpp::PacketTrailerLayer, pcpp::NullLoopbackLayer, pcpp::NtpLayer, pcpp::NflogLayer, pcpp::MplsLayer, pcpp::ModbusLayer, pcpp::LLCLayer, pcpp::LdapLayer, pcpp::IPv6Layer, pcpp::IPv4Layer, pcpp::ESPLayer, pcpp::AuthenticationHeaderLayer, pcpp::IgmpLayer, pcpp::IcmpV6Layer, pcpp::IcmpLayer, pcpp::HttpMessage, pcpp::GtpV2Layer, pcpp::GtpV1Layer, pcpp::PPP_PPTPLayer, pcpp::GreLayer, pcpp::FtpLayer, pcpp::EthLayer, pcpp::EthDot3Layer, pcpp::DoIpLayer, pcpp::DnsLayer, pcpp::DhcpV6Layer, pcpp::DhcpLayer, pcpp::CotpLayer, pcpp::CiscoHdlcLayer, pcpp::BgpLayer, and pcpp::ArpLayer.

getPrevLayer()

Layer* pcpp::Layer::getPrevLayer ( ) const

inline

Returns

A pointer to the previous layer in the protocol stack or nullptr if the layer is the first one

getProtocol()

ProtocolType pcpp::Layer::getProtocol ( ) const

inline

Returns

The protocol enum

isAllocatedToPacket()

bool pcpp::Layer::isAllocatedToPacket ( ) const

inline

Raw data in layers can come from one of sources:

1. from an existing packet - this is the case when parsing packets received from files or the network. In this case the data was already allocated by someone else, and layer only holds the pointer to the relevant place inside this data
2. when creating packets, data is allocated when layer is created. In this case the layer is responsible for freeing it as well

Returns

Returns true if the data was allocated by an external source (a packet) or false if it was allocated by the layer itself

isMemberOfProtocolFamily()

bool pcpp::Layer::isMemberOfProtocolFamily

(

ProtocolTypeFamily

protocolTypeFamily

)

const

Check if the layer's protocol matches a protocol family

Parameters

protocolTypeFamily

The protocol family to check

Returns

True if the layer's protocol matches the protocol family, false otherwise

toString()

virtual std::string pcpp::Layer::toString ( ) const

pure virtual

Returns

A string representation of the layer most important data (should look like the layer description in Wireshark)

Implemented in pcpp::WireGuardLayer, pcpp::WakeOnLanLayer, pcpp::VxlanLayer, pcpp::VrrpLayer, pcpp::VlanLayer, pcpp::UdpLayer, pcpp::TpktLayer, pcpp::TelnetLayer, pcpp::TcpLayer, pcpp::MultipleStpLayer, pcpp::RapidStpLayer, pcpp::StpConfigurationBPDULayer, pcpp::StpTopologyChangeBPDULayer, pcpp::SSLApplicationDataLayer, pcpp::SSLAlertLayer, pcpp::SSLChangeCipherSpecLayer, pcpp::SSLHandshakeLayer, pcpp::SSHEncryptedMessage, pcpp::SSHHandshakeMessage, pcpp::SSHIdentificationMessage, pcpp::SomeIpSdLayer, pcpp::SomeIpTpLayer, pcpp::SomeIpLayer, pcpp::SmtpResponseLayer, pcpp::SmtpRequestLayer, pcpp::SllLayer, pcpp::Sll2Layer, pcpp::SipResponseLayer, pcpp::SipRequestLayer, pcpp::SdpLayer, pcpp::S7CommLayer, pcpp::RadiusLayer, pcpp::PPPoEDiscoveryLayer, pcpp::PPPoESessionLayer, pcpp::PayloadLayer, pcpp::PacketTrailerLayer, pcpp::NullLoopbackLayer, pcpp::NtpLayer, pcpp::NflogLayer, pcpp::NDPNeighborAdvertisementLayer, pcpp::NDPNeighborSolicitationLayer, pcpp::MplsLayer, pcpp::ModbusLayer, pcpp::LLCLayer, pcpp::LdapLayer, pcpp::IPv6Layer, pcpp::IPv4Layer, pcpp::ESPLayer, pcpp::AuthenticationHeaderLayer, pcpp::IgmpLayer, pcpp::ICMPv6EchoLayer, pcpp::IcmpV6Layer, pcpp::IcmpLayer, pcpp::HttpResponseLayer, pcpp::HttpRequestLayer, pcpp::GtpV2Layer, pcpp::GtpV1Layer, pcpp::PPP_PPTPLayer, pcpp::GREv1Layer, pcpp::GREv0Layer, pcpp::FtpDataLayer, pcpp::FtpResponseLayer, pcpp::FtpRequestLayer, pcpp::EthLayer, pcpp::EthDot3Layer, pcpp::DoIpLayer, pcpp::DnsLayer, pcpp::DhcpV6Layer, pcpp::DhcpLayer, pcpp::CotpLayer, pcpp::CiscoHdlcLayer, pcpp::BgpLayer, and pcpp::ArpLayer.

tryConstructNextLayer() [1/2]

template<typename T , typename... Args>

Layer* pcpp::Layer::tryConstructNextLayer ( uint8_t *  data, size_t  dataLen, Args &&...  extraArgs  )

inlineprotected

Try to construct the next layer in the protocol stack.

This overload infers the Packet from the current layer.

The method checks if the data is valid for the layer type T before constructing it by calling T::isDataValid(data, dataLen). If the data is invalid, no layer is constructed and a nullptr is returned.

Template Parameters

T	The type of the layer to construct
Args	The types of the extra arguments to pass to the layer constructor

Parameters

[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	extraArgs	Extra arguments to be forwarded to the layer constructor

Returns

The constructed layer or nullptr if the data is invalid

tryConstructNextLayer() [2/2]

template<typename T , typename... Args>

Layer* pcpp::Layer::tryConstructNextLayer ( uint8_t *  data, size_t  dataLen, Packet *  packet, Args &&...  extraArgs  )

inlineprotected

Try to construct the next layer in the protocol stack.

The method checks if the data is valid for the layer type T before constructing it by calling T::isDataValid(data, dataLen). If the data is invalid, no layer is constructed and a nullptr is returned.

Template Parameters

T	The type of the layer to construct
Args	The types of the extra arguments to pass to the layer constructor

Parameters

[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	packet	The packet the layer belongs to
[in]	extraArgs	Extra arguments to be forwarded to the layer constructor

Returns

The constructed layer or nullptr if the data is invalid

tryConstructNextLayerFromFactoryWithFallback() [1/2]

template<typename TFallback , typename TFactory , typename... Args>

Layer* pcpp::Layer::tryConstructNextLayerFromFactoryWithFallback ( TFactory  factoryFn, uint8_t *  data, size_t  dataLen, Args &&...  extraArgs  )

inlineprotected

Try to construct the next layer in the protocol stack using a factory functor with a fallback option.

The method will attempt to construct the next layer using the provided factory function. If the factory function returns nullptr, indicating failure to create the layer, the method will then construct a layer of type TFallback.

The factory functor is expected to have the following signature: Layer* factoryFn(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet, ...);

This overload infers the Packet from the current layer.

Template Parameters

TFallback	The fallback layer type to construct if the factory fails.
TFactory	The factory functor type.
...Args	Parameter pack for extra arguments to pass to the factory functor.

Parameters

[in]	factoryFn	The factory functor to create the layer.
[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	extraArgs	Extra arguments to be forwarded to the factory.

Returns

The return value of the factory functor.

Remarks

The parameters extraArgs are forwarded to the factory function, but not to the TFallback constructor.

tryConstructNextLayerFromFactoryWithFallback() [2/2]

template<typename TFallback , typename TFactory , typename... Args>

Layer* pcpp::Layer::tryConstructNextLayerFromFactoryWithFallback ( TFactory  factoryFn, uint8_t *  data, size_t  dataLen, Packet *  packet, Args &&...  extraArgs  )

inlineprotected

Try to construct the next layer in the protocol stack using a factory functor with a fallback option.

The method will attempt to construct the next layer using the provided factory function. If the factory function returns nullptr, indicating failure to create the layer, the method will then construct a layer of type TFallback.

The factory functor is expected to have the following signature: Layer* factoryFn(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet, ...);

Template Parameters

TFallback	The fallback layer type to construct if the factory fails.
TFactory	The factory functor type.
...Args	Parameter pack for extra arguments to pass to the factory functor.

Parameters

[in]	factoryFn	The factory functor to create the layer.
[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	packet	The packet the layer belongs to
[in]	extraArgs	Extra arguments to be forwarded to the factory.

Returns

The return value of the factory functor.

Remarks

The parameters extraArgs are forwarded to the factory function, but not to the TFallback constructor.

tryConstructNextLayerWithFallback() [1/2]

template<typename T , typename TFallback , typename... Args>

Layer* pcpp::Layer::tryConstructNextLayerWithFallback ( uint8_t *  data, size_t  dataLen, Args &&...  extraArgs  )

inlineprotected

Try to construct the next layer in the protocol stack with a fallback option.

This overload infers the Packet from the current layer.

The method checks if the data is valid for the layer type T before constructing it by calling T::isDataValid(data, dataLen). If the data is invalid, it constructs the layer of type TFallback.

Template Parameters

T	The type of the layer to construct
TFallback	The fallback layer type to construct if T fails
Args	The types of the extra arguments to pass to the layer constructor of T

Parameters

[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	extraArgs	Extra arguments to be forwarded to the layer constructor of T

Returns

The constructed layer of type T or TFallback

Remarks

The parameters extraArgs are forwarded to the factory function, but not to the TFallback constructor.

tryConstructNextLayerWithFallback() [2/2]

template<typename T , typename TFallback , typename... Args>

Layer* pcpp::Layer::tryConstructNextLayerWithFallback ( uint8_t *  data, size_t  dataLen, Packet *  packet, Args &&...  extraArgs  )

inlineprotected

Try to construct the next layer in the protocol stack with a fallback option.

The method checks if the data is valid for the layer type T before constructing it by calling T::isDataValid(data, dataLen). If the data is invalid, it constructs the layer of type TFallback.

Template Parameters

T	The type of the layer to construct
TFallback	The fallback layer type to construct if T fails
Args	The types of the extra arguments to pass to the layer constructor of T

Parameters

[in]	data	The data to construct the layer from
[in]	dataLen	The length of the data
[in]	packet	The packet the layer belongs to
[in]	extraArgs	Extra arguments to be forwarded to the layer constructor of T

Returns

The constructed layer of type T or TFallback

Remarks

The parameters extraArgs are forwarded to the factory function, but not to the TFallback constructor.