#include <RawPacket.h>

Inheritance diagram for pcpp::RawPacket:

Public Member Functions
	RawPacket (const uint8_t *pRawData, int rawDataLen, timeval timestamp, bool deleteRawDataAtDestructor, LinkLayerType layerType=LINKTYPE_ETHERNET)

	RawPacket (const uint8_t *pRawData, int rawDataLen, timespec timestamp, bool deleteRawDataAtDestructor, LinkLayerType layerType=LINKTYPE_ETHERNET)

	RawPacket ()

virtual	~RawPacket ()

	RawPacket (const RawPacket &other)

RawPacket &	operator= (const RawPacket &other)

virtual RawPacket *	clone () const
	Clones the current packet. Caller is responsible for deallocation of the memory. More...

virtual uint8_t	getObjectType () const

virtual bool	setRawData (const uint8_t *pRawData, int rawDataLen, timeval timestamp, LinkLayerType layerType=LINKTYPE_ETHERNET, int frameLength=-1)

virtual bool	setRawData (const uint8_t *pRawData, int rawDataLen, timespec timestamp, LinkLayerType layerType=LINKTYPE_ETHERNET, int frameLength=-1)

bool	initWithRawData (const uint8_t *pRawData, int rawDataLen, timespec timestamp, LinkLayerType layerType=LINKTYPE_ETHERNET)

const uint8_t *	getRawData () const

LinkLayerType	getLinkLayerType () const

int	getRawDataLen () const

int	getFrameLength () const

timespec	getPacketTimeStamp () const

virtual bool	setPacketTimeStamp (timeval timestamp)

virtual bool	setPacketTimeStamp (timespec timestamp)

bool	isPacketSet () const

virtual void	clear ()

virtual void	appendData (const uint8_t *dataToAppend, size_t dataToAppendLen)

virtual void	insertData (int atIndex, const uint8_t *dataToInsert, size_t dataToInsertLen)

virtual bool	removeData (int atIndex, size_t numOfBytesToRemove)

virtual bool	reallocateData (size_t newBufferLength)

Static Public Member Functions
static bool	isLinkTypeValid (int linkTypeValue)

Detailed Description

This class holds the packet as raw (not parsed) data. The data is held as byte array. In addition to the data itself every instance also holds a timestamp representing the time the packet was received by the NIC. RawPacket instance isn't read only. The user can change the packet data, add or remove data, etc.

Constructor & Destructor Documentation

◆ RawPacket() [1/4]

pcpp::RawPacket::RawPacket	(	const uint8_t *	pRawData,
		int	rawDataLen,
		timeval	timestamp,
		bool	deleteRawDataAtDestructor,
		LinkLayerType	layerType = `LINKTYPE_ETHERNET`
	)

A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.). The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has arrived to the device

Parameters

[in]	pRawData	A pointer to the raw data
[in]	rawDataLen	The raw data length in bytes
[in]	timestamp	The timestamp packet was received by the NIC (in usec precision)
[in]	deleteRawDataAtDestructor	An indicator whether raw data pointer should be freed when the instance is freed or not. If set to 'true' than pRawData will be freed when instanced is being freed
[in]	layerType	The link layer type of this raw packet. The default is Ethernet

◆ RawPacket() [2/4]

pcpp::RawPacket::RawPacket	(	const uint8_t *	pRawData,
		int	rawDataLen,
		timespec	timestamp,
		bool	deleteRawDataAtDestructor,
		LinkLayerType	layerType = `LINKTYPE_ETHERNET`
	)

A constructor that receives a pointer to the raw data (allocated elsewhere). This constructor is usually used when packet is captured using a packet capturing engine (like libPcap. WinPcap, Npcap, PF_RING, etc.). The capturing engine allocates the raw data memory and give the user a pointer to it + a timestamp it has arrived to the device

Parameters

[in]	pRawData	A pointer to the raw data
[in]	rawDataLen	The raw data length in bytes
[in]	timestamp	The timestamp packet was received by the NIC (in nsec precision)
[in]	deleteRawDataAtDestructor	An indicator whether raw data pointer should be freed when the instance is freed or not. If set to 'true' than pRawData will be freed when instanced is being freed
[in]	layerType	The link layer type of this raw packet. The default is Ethernet

◆ RawPacket() [3/4]

pcpp::RawPacket::RawPacket ( )

A default constructor that initializes class'es attributes to default value:

data pointer is set to nullptr
data length is set to 0
deleteRawDataAtDestructor is set to 'true'

◆ ~RawPacket()

virtual pcpp::RawPacket::~RawPacket ( )

virtual

A destructor for this class. Frees the raw data if deleteRawDataAtDestructor was set to 'true'

◆ RawPacket() [4/4]

pcpp::RawPacket::RawPacket ( const RawPacket & other )

A copy constructor that copies all data from another instance. Notice all raw data is copied (using memcpy), so when the original or the other instance are freed, the other won't be affected

Parameters

[in] other The instance to copy from

Member Function Documentation

◆ appendData()

virtual void pcpp::RawPacket::appendData	(	const uint8_t *	dataToAppend,
		size_t	dataToAppendLen
	)

virtual

Append data to the end of current data. This method works without allocating more memory, it just uses memcpy() to copy dataToAppend at the end of the current data. This means that the method assumes this memory was already allocated by the user. If it isn't the case then this method will cause memory corruption

Parameters

[in]	dataToAppend	A pointer to the data to append to current raw data
[in]	dataToAppendLen	Length in bytes of dataToAppend

Reimplemented in pcpp::MBufRawPacket.

◆ clear()

virtual void pcpp::RawPacket::clear ( )

virtual

Clears all members of this instance, meaning setting raw data to nullptr, raw data length to 0, etc. Currently raw data is always freed, even if deleteRawDataAtDestructor was set to 'false'

Reimplemented in pcpp::MBufRawPacket.

◆ clone()

virtual RawPacket* pcpp::RawPacket::clone ( ) const

virtual

Clones the current packet. Caller is responsible for deallocation of the memory.

Returns: A pointer to the new RawPacket object which is a clone of this object

Reimplemented in pcpp::MBufRawPacket.

◆ getFrameLength()

int pcpp::RawPacket::getFrameLength ( ) const

inline

Get frame length in bytes

Returns: frame length in bytes

◆ getLinkLayerType()

LinkLayerType pcpp::RawPacket::getLinkLayerType ( ) const

inline

Get the link layer type

Returns: the type of the link layer

◆ getObjectType()

virtual uint8_t pcpp::RawPacket::getObjectType ( ) const

inlinevirtual

Returns: RawPacket object type. Each derived class should return a different value

Reimplemented in pcpp::MBufRawPacket.

◆ getPacketTimeStamp()

timespec pcpp::RawPacket::getPacketTimeStamp ( ) const

inline

Get raw data timestamp

Returns: Raw data timestamp

◆ getRawData()

const uint8_t* pcpp::RawPacket::getRawData ( ) const

inline

Get raw data pointer

Returns: A read-only pointer to the raw data

◆ getRawDataLen()

int pcpp::RawPacket::getRawDataLen ( ) const

inline

Get raw data length in bytes

Returns: Raw data length in bytes

◆ initWithRawData()

bool pcpp::RawPacket::initWithRawData	(	const uint8_t *	pRawData,
		int	rawDataLen,
		timespec	timestamp,
		LinkLayerType	layerType = `LINKTYPE_ETHERNET`
	)

Initialize a raw packet with data. The main difference between this method and setRawData() is that setRawData() is meant for replacing the data in an existing raw packet, whereas this method is meant to be used right after constructing a raw packet using the default c'tor, before setting any data

Parameters

pRawData	A pointer to the new raw data
rawDataLen	The new raw data length in bytes
timestamp	The timestamp packet was received by the NIC (in nsec precision)
layerType	The link layer type for this raw data

Returns: True if raw data was set successfully, false otherwise

◆ insertData()

virtual void pcpp::RawPacket::insertData	(	int	atIndex,
		const uint8_t *	dataToInsert,
		size_t	dataToInsertLen
	)

virtual

Insert new data at some index of the current data and shift the remaining old data to the end. This method works without allocating more memory, it just copies dataToAppend at the relevant index and shifts the remaining data to the end. This means that the method assumes this memory was already allocated by the user. If it isn't the case then this method will cause memory corruption

Parameters

[in]	atIndex	The index to insert the new data to
[in]	dataToInsert	A pointer to the new data to insert
[in]	dataToInsertLen	Length in bytes of dataToInsert

Reimplemented in pcpp::MBufRawPacket.

◆ isLinkTypeValid()

static bool pcpp::RawPacket::isLinkTypeValid ( int linkTypeValue )

static

This static method validates whether a link type integer value is valid

Parameters

[in] linkTypeValue Link type integer value

Returns: True if the link type value is valid and can be casted into LinkLayerType enum, false otherwise

◆ isPacketSet()

bool pcpp::RawPacket::isPacketSet ( ) const

inline

Get an indication whether raw data was already set for this instance.

Returns: True if raw data was set for this instance. Raw data can be set using the non-default constructor, using setRawData(), using the copy constructor or using the assignment operator. Returns false otherwise, for example: if the instance was created using the default constructor or clear() was called

◆ operator=()

RawPacket& pcpp::RawPacket::operator= ( const RawPacket & other )

Assignment operator overload for this class. When using this operator on an already initialized RawPacket instance, the original raw data is freed first. Then the other instance is copied to this instance, the same way the copy constructor works

Parameters

[in] other The instance to copy from

◆ reallocateData()

virtual bool pcpp::RawPacket::reallocateData ( size_t newBufferLength )

virtual

Re-allocate raw packet buffer meaning add size to it without losing the current packet data. This method allocates the required buffer size as instructed by the use and then copies the raw data from the current allocated buffer to the new one. This method can become useful if the user wants to insert or append data to the raw data, and the previous allocated buffer is too small, so the user wants to allocate a larger buffer and get RawPacket instance to point to it

Parameters

[in] newBufferLength The new buffer length as required by the user. The method is responsible to allocate the memory

Returns: True if data was reallocated successfully, false otherwise

Reimplemented in pcpp::MBufRawPacket.

◆ removeData()

virtual bool pcpp::RawPacket::removeData	(	int	atIndex,
		size_t	numOfBytesToRemove
	)

virtual

Remove certain number of bytes from current raw data buffer. All data after the removed bytes will be shifted back

Parameters

[in]	atIndex	The index to start removing bytes from
[in]	numOfBytesToRemove	Number of bytes to remove

Returns: True if all bytes were removed successfully, or false if atIndex+numOfBytesToRemove is out-of-bounds of the raw data buffer

Reimplemented in pcpp::MBufRawPacket.

◆ setPacketTimeStamp() [1/2]

virtual bool pcpp::RawPacket::setPacketTimeStamp ( timespec timestamp )

virtual

Set raw packet timestamp with nsec precision

Parameters

[in] timestamp The timestamp to set (with nsec precision)

Returns: True if timestamp was set successfully, false otherwise

◆ setPacketTimeStamp() [2/2]

virtual bool pcpp::RawPacket::setPacketTimeStamp ( timeval timestamp )

virtual

Set raw packet timestamp with usec precision

Parameters

[in] timestamp The timestamp to set (with usec precision)

Returns: True if timestamp was set successfully, false otherwise

◆ setRawData() [1/2]

virtual bool pcpp::RawPacket::setRawData	(	const uint8_t *	pRawData,
		int	rawDataLen,
		timespec	timestamp,
		LinkLayerType	layerType = `LINKTYPE_ETHERNET`,
		int	frameLength = `-1`
	)

virtual

Set a raw data. If data was already set and deleteRawDataAtDestructor was set to 'true' the old data will be freed first

Parameters

[in]	pRawData	A pointer to the new raw data
[in]	rawDataLen	The new raw data length in bytes
[in]	timestamp	The timestamp packet was received by the NIC (in nsec precision)
[in]	layerType	The link layer type for this raw data
[in]	frameLength	When reading from pcap files, sometimes the captured length is different from the actual packet length. This parameter represents the packet length. This parameter is optional, if not set or set to -1 it is assumed both lengths are equal

Returns: True if raw data was set successfully, false otherwise

Reimplemented in pcpp::MBufRawPacket.

◆ setRawData() [2/2]

virtual bool pcpp::RawPacket::setRawData	(	const uint8_t *	pRawData,
		int	rawDataLen,
		timeval	timestamp,
		LinkLayerType	layerType = `LINKTYPE_ETHERNET`,
		int	frameLength = `-1`
	)

virtual

Set a raw data. If data was already set and deleteRawDataAtDestructor was set to 'true' the old data will be freed first

Parameters

[in]	pRawData	A pointer to the new raw data
[in]	rawDataLen	The new raw data length in bytes
[in]	timestamp	The timestamp packet was received by the NIC (in usec precision)
[in]	layerType	The link layer type for this raw data
[in]	frameLength	When reading from pcap files, sometimes the captured length is different from the actual packet length. This parameter represents the packet length. This parameter is optional, if not set or set to -1 it is assumed both lengths are equal

Returns: True if raw data was set successfully, false otherwise

Public Member Functions

Static Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ RawPacket() [1/4]

◆ RawPacket() [2/4]

◆ RawPacket() [3/4]

◆ ~RawPacket()

◆ RawPacket() [4/4]

Member Function Documentation

◆ appendData()

◆ clear()

◆ clone()

◆ getFrameLength()

◆ getLinkLayerType()

◆ getObjectType()

◆ getPacketTimeStamp()

◆ getRawData()

◆ getRawDataLen()

◆ initWithRawData()

◆ insertData()

◆ isLinkTypeValid()

◆ isPacketSet()

◆ operator=()

◆ reallocateData()

◆ removeData()

◆ setPacketTimeStamp() [1/2]

◆ setPacketTimeStamp() [2/2]

◆ setRawData() [1/2]

◆ setRawData() [2/2]