#include <Packet.h>

Public Member Functions
	Packet (size_t maxPacketLen=1)

	Packet (RawPacket *rawPacket, bool freeRawPacket=false, ProtocolType parseUntil=UnknownProtocol, OsiModelLayer parseUntilLayer=OsiModelLayerUnknown)

	Packet (RawPacket *rawPacket, ProtocolType parseUntil)

	Packet (RawPacket *rawPacket, OsiModelLayer parseUntilLayer)

virtual	~Packet ()

	Packet (const Packet &other)

Packet &	operator= (const Packet &other)

RawPacket *	getRawPacket () const

void	setRawPacket (RawPacket *rawPacket, bool freeRawPacket, ProtocolType parseUntil=UnknownProtocol, OsiModelLayer parseUntilLayer=OsiModelLayerUnknown)

RawPacket *	getRawPacketReadOnly () const

Layer *	getFirstLayer () const

Layer *	getLastLayer () const

bool	addLayer (Layer *newLayer, bool ownInPacket=false)

bool	insertLayer (Layer prevLayer, Layer newLayer, bool ownInPacket=false)

bool	removeLayer (ProtocolType layerType, int index=0)

bool	removeFirstLayer ()

bool	removeLastLayer ()

bool	removeAllLayersAfter (Layer *layer)

Layer *	detachLayer (ProtocolType layerType, int index=0)

bool	detachLayer (Layer *layer)

Layer *	getLayerOfType (ProtocolType layerType, int index=0) const

template<class TLayer >
TLayer *	getLayerOfType (bool reverseOrder=false) const

template<class TLayer >
TLayer *	getNextLayerOfType (Layer *startLayer) const

template<class TLayer >
TLayer *	getPrevLayerOfType (Layer *startLayer) const

bool	isPacketOfType (ProtocolType protocolType) const

void	computeCalculateFields ()

std::string	toString (bool timeAsLocalTime=true)

void	toStringList (std::vector< std::string > &result, bool timeAsLocalTime=true) const

Detailed Description

This class represents a parsed packet. It contains the raw data (RawPacket instance), and a linked list of layers, each layer is a parsed protocol that this packet contains. The layers linked list is ordered where the first layer is the lowest in the packet (currently it's always Ethernet protocol as PcapPlusPlus supports only Ethernet packets), the next layer will be L2.5 or L3 (e.g VLAN, IPv4, IPv6, etc.), and so on. etc.), etc. The last layer in the linked list will be the highest in the packet. For example: for a standard HTTP request packet the layer will look like this: EthLayer -> IPv4Layer -> TcpLayer -> HttpRequestLayer
Packet instance isn't read only. The user can add or remove layers, update current layer, etc.

Constructor & Destructor Documentation

◆ Packet() [1/5]

pcpp::Packet::Packet ( size_t maxPacketLen = 1 )

A constructor for creating a new packet. Very useful when creating packets. When using this constructor an empty raw buffer is allocated (with the size of maxPacketLen) and a new RawPacket is created

Parameters

[in] maxPacketLen The expected packet length in bytes

◆ Packet() [2/5]

pcpp::Packet::Packet	(	RawPacket *	rawPacket,
		bool	freeRawPacket = `false`,
		ProtocolType	parseUntil = `UnknownProtocol`,
		OsiModelLayer	parseUntilLayer = `OsiModelLayerUnknown`
	)

A constructor for creating a packet out of already allocated RawPacket. Very useful when parsing packets that came from the network. When using this constructor a pointer to the RawPacket is saved (data isn't copied) and the RawPacket is parsed, meaning all layers are created and linked to each other in the right order. In this overload of the constructor the user can specify whether to free the instance of raw packet when the Packet is free or not

Parameters

[in]	rawPacket	A pointer to the raw packet
[in]	freeRawPacket	Optional parameter. A flag indicating if the destructor should also call the raw packet destructor or not. Default value is false
[in]	parseUntil	Optional parameter. Parse the packet until you reach a certain protocol (inclusive). Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is UnknownProtocol which means don't take this parameter into account
[in]	parseUntilLayer	Optional parameter. Parse the packet until you reach a certain layer in the OSI model (inclusive). Can be useful for cases when you need to parse only up to a certain OSI layer (for example transport layer) and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is OsiModelLayerUnknown which means don't take this parameter into account

◆ Packet() [3/5]

pcpp::Packet::Packet	(	RawPacket *	rawPacket,
		ProtocolType	parseUntil
	)

A constructor for creating a packet out of already allocated RawPacket. Very useful when parsing packets that came from the network. When using this constructor a pointer to the RawPacket is saved (data isn't copied) and the RawPacket is parsed, meaning all layers are created and linked to each other in the right order. In this overload of the constructor the user can specify whether to free the instance of raw packet when the Packet is free or not. This constructor should be used to parse the packet up to a certain layer

Parameters

[in]	rawPacket	A pointer to the raw packet
[in]	parseUntil	Optional parameter. Parse the packet until you reach a certain protocol (inclusive). Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet

◆ Packet() [4/5]

pcpp::Packet::Packet	(	RawPacket *	rawPacket,
		OsiModelLayer	parseUntilLayer
	)

A constructor for creating a packet out of already allocated RawPacket. Very useful when parsing packets that came from the network. When using this constructor a pointer to the RawPacket is saved (data isn't copied) and the RawPacket is parsed, meaning all layers are created and linked to each other in the right order. In this overload of the constructor the user can specify whether to free the instance of raw packet when the Packet is free or not. . This constructor should be used to parse the packet up to a certain layer in the OSI model

Parameters

[in]	rawPacket	A pointer to the raw packet
[in]	parseUntilLayer	Optional parameter. Parse the packet until you reach a certain layer in the OSI model (inclusive). Can be useful for cases when you need to parse only up to a certain OSI layer (for example transport layer) and want to avoid the performance impact and memory consumption of parsing the whole packet

◆ ~Packet()

virtual pcpp::Packet::~Packet ( )

inlinevirtual

A destructor for this class. Frees all layers allocated by this instance (Notice: it doesn't free layers that weren't allocated by this class, for example layers that were added by addLayer() or insertLayer() ). In addition it frees the raw packet if it was allocated by this instance (meaning if it was allocated by this instance constructor)

◆ Packet() [5/5]

pcpp::Packet::Packet ( const Packet & other )

inline

A copy constructor for this class. This copy constructor copies all the raw data and re-create all layers. So when the original Packet is being freed, no data will be lost in the copied instance

Parameters

[in] other The instance to copy from

Member Function Documentation

◆ addLayer()

bool pcpp::Packet::addLayer	(	Layer *	newLayer,
		bool	ownInPacket = `false`
	)

inline

Add a new layer as the last layer in the packet. This method gets a pointer to the new layer as a parameter and attaches it to the packet. Notice after calling this method the input layer is attached to the packet so every change you make in it affect the packet; Also it cannot be attached to other packets

Parameters

[in]	newLayer	A pointer to the new layer to be added to the packet
[in]	ownInPacket	If true, Packet fully owns newLayer, including memory deletion upon destruct. Default is false.

Returns: True if everything went well or false otherwise (an appropriate error log message will be printed in such cases)

◆ computeCalculateFields()

void pcpp::Packet::computeCalculateFields ( )

Each layer can have fields that can be calculate automatically from other fields using Layer::computeCalculateFields(). This method forces all layers to calculate these fields values

◆ detachLayer() [1/2]

Layer* pcpp::Packet::detachLayer	(	ProtocolType	layerType,
		int	index = `0`
	)

Detach a layer from the packet. Detaching means the layer instance will not be deleted, but rather seperated from the packet - e.g it will be removed from the layer chain of the packet and its data will be copied from the packet buffer into an internal layer buffer. After a layer is detached, it can be added into another packet (but it's impossible to attach a layer to multiple packets in the same time). After layer is detached, it's the user's responsibility to delete it when it's not needed anymore

Parameters

[in]	layerType	The layer type (protocol) to detach from the packet
[in]	index	If there are multiple layers of the same type, indicate which instance to detach. The default value is 0, meaning detach the first layer of this type

Returns: A pointer to the detached layer or NULL if detaching process failed. In any case of failure an appropriate error log message will be printed

◆ detachLayer() [2/2]

bool pcpp::Packet::detachLayer ( Layer * layer )

inline

Detach a layer from the packet. Detaching means the layer instance will not be deleted, but rather seperated from the packet - e.g it will be removed from the layer chain of the packet and its data will be copied from the packet buffer into an internal layer buffer. After a layer is detached, it can be added into another packet (but it's impossible to attach a layer to multiple packets at the same time). After layer is detached, it's the user's responsibility to delete it when it's not needed anymore

Parameters

[in] layer A pointer to the layer to detach

Returns: True if the layer was detached successfully, or false if something went wrong. In any case of failure an appropriate error log message will be printed

◆ getFirstLayer()

Layer* pcpp::Packet::getFirstLayer ( ) const

inline

Get a pointer to the first (lowest) layer in the packet

Returns: A pointer to the first (lowest) layer in the packet

◆ getLastLayer()

Layer* pcpp::Packet::getLastLayer ( ) const

inline

Get a pointer to the last (highest) layer in the packet

Returns: A pointer to the last (highest) layer in the packet

◆ getLayerOfType() [1/2]

Layer* pcpp::Packet::getLayerOfType	(	ProtocolType	layerType,
		int	index = `0`
	)		const

Get a pointer to the layer of a certain type (protocol). This method goes through the layers and returns a layer that matches the give protocol type

Parameters

[in]	layerType	The layer type (protocol) to fetch
[in]	index	If there are multiple layers of the same type, indicate which instance to fetch. The default value is 0, meaning fetch the first layer of this type

Returns: A pointer to the layer or NULL if no such layer was found

◆ getLayerOfType() [2/2]

template<class TLayer >

TLayer * pcpp::Packet::getLayerOfType ( bool reverseOrder = false ) const

A templated method to get a layer of a certain type (protocol). If no layer of such type is found, NULL is returned

Parameters

[in] reverseOrder The optional paramter that indicates that the lookup should run in reverse order, the default value is false

Returns: A pointer to the layer of the requested type, NULL if not found

◆ getNextLayerOfType()

template<class TLayer >

TLayer * pcpp::Packet::getNextLayerOfType ( Layer * startLayer ) const

A templated method to get the first layer of a certain type (protocol), start searching from a certain layer. For example: if a packet looks like: EthLayer -> VlanLayer(1) -> VlanLayer(2) -> VlanLayer(3) -> IPv4Layer and the user put VlanLayer(2) as a parameter and wishes to search for a VlanLayer, VlanLayer(3) will be returned If no layer of such type is found, NULL is returned

Parameters

[in] startLayer A pointer to the layer to start search from

Returns: A pointer to the layer of the requested type, NULL if not found

◆ getPrevLayerOfType()

template<class TLayer >

TLayer * pcpp::Packet::getPrevLayerOfType ( Layer * startLayer ) const

A templated method to get the first layer of a certain type (protocol), start searching from a certain layer. For example: if a packet looks like: EthLayer -> VlanLayer(1) -> VlanLayer(2) -> VlanLayer(3) -> IPv4Layer and the user put VlanLayer(2) as a parameter and wishes to search for a VlanLayer, VlanLayer(1) will be returned If no layer of such type is found, NULL is returned

Parameters

[in] startLayer A pointer to the layer to start search from

Returns: A pointer to the layer of the requested type, NULL if not found

◆ getRawPacket()

RawPacket* pcpp::Packet::getRawPacket ( ) const

inline

Get a pointer to the Packet's RawPacket

Returns: A pointer to the Packet's RawPacket

◆ getRawPacketReadOnly()

RawPacket* pcpp::Packet::getRawPacketReadOnly ( ) const

inline

Get a pointer to the Packet's RawPacket in a read-only manner

Returns: A pointer to the Packet's RawPacket

◆ insertLayer()

bool pcpp::Packet::insertLayer	(	Layer *	prevLayer,
		Layer *	newLayer,
		bool	ownInPacket = `false`
	)

Insert a new layer after an existing layer in the packet. This method gets a pointer to the new layer as a parameter and attaches it to the packet. Notice after calling this method the input layer is attached to the packet so every change you make in it affect the packet; Also it cannot be attached to other packets

Parameters

[in]	prevLayer	A pointer to an existing layer in the packet which the new layer should followed by. If this layer isn't attached to a packet and error will be printed to log and false will be returned
[in]	newLayer	A pointer to the new layer to be added to the packet
[in]	ownInPacket	If true, Packet fully owns newLayer, including memory deletion upon destruct. Default is false.

Returns: True if everything went well or false otherwise (an appropriate error log message will be printed in such cases)

◆ isPacketOfType()

bool pcpp::Packet::isPacketOfType ( ProtocolType protocolType ) const

inline

Check whether the packet contains a certain protocol

Parameters

[in] protocolType The protocol type to search

Returns: True if the packet contains the protocol, false otherwise

◆ operator=()

Packet& pcpp::Packet::operator= ( const Packet & other )

Assignment operator overloading. It first frees all layers allocated by this instance (Notice: it doesn't free layers that weren't allocated by this class, for example layers that were added by addLayer() or insertLayer() ). In addition it frees the raw packet if it was allocated by this instance (meaning if it was allocated by this instance constructor). Afterwards it copies the data from the other packet in the same way used in the copy constructor.

Parameters

[in] other The instance to copy from

◆ removeAllLayersAfter()

bool pcpp::Packet::removeAllLayersAfter ( Layer * layer )

Remove all layers that come after a certain layer. All layers removed will be deleted if they were allocated during packet creation or detached if were allocated outside of the packet, please refer to removeLayer() to get more info

Parameters

[in] layer A pointer to the layer to begin removing from. Please note this layer will not be removed, only the layers that come after it will be removed. Also, if removal of one layer failed, the method will return immediately and the following layers won't be deleted

Returns: True if all layers were removed successfully, or false if failed to remove at least one layer. In any case of failure an appropriate error log message will be printed

◆ removeFirstLayer()

bool pcpp::Packet::removeFirstLayer ( )

Remove the first layer in the packet. The layer will be deleted if it was allocated during packet creation, or detached if was allocated outside of the packet. Please refer to removeLayer() to get more info

Returns: True if layer removed successfully, or false if removing the layer failed or if there are no layers in the packet. In any case of failure an appropriate error log message will be printed

◆ removeLastLayer()

bool pcpp::Packet::removeLastLayer ( )

Remove the last layer in the packet. The layer will be deleted if it was allocated during packet creation, or detached if was allocated outside of the packet. Please refer to removeLayer() to get more info

Returns: True if layer removed successfully, or false if removing the layer failed or if there are no layers in the packet. In any case of failure an appropriate error log message will be printed

◆ removeLayer()

bool pcpp::Packet::removeLayer	(	ProtocolType	layerType,
		int	index = `0`
	)

Remove an existing layer from the packet. The layer to removed is identified by its type (protocol). If the packet has multiple layers of the same type in the packet the user may specify the index of the layer to remove (the default index is 0 - remove the first layer of this type). If the layer was allocated during packet creation it will be deleted and any pointer to it will get invalid. However if the layer was allocated by the user and manually added to the packet it will simply get detached from the packet, meaning the pointer to it will stay valid and its data (that was removed from the packet) will be copied back to the layer. In that case it's the user's responsibility to delete the layer instance

Parameters

[in]	layerType	The layer type (protocol) to remove
[in]	index	If there are multiple layers of the same type, indicate which instance to remove. The default value is 0, meaning remove the first layer of this type

Returns: True if everything went well or false otherwise (an appropriate error log message will be printed in such cases)

◆ setRawPacket()

void pcpp::Packet::setRawPacket	(	RawPacket *	rawPacket,
		bool	freeRawPacket,
		ProtocolType	parseUntil = `UnknownProtocol`,
		OsiModelLayer	parseUntilLayer = `OsiModelLayerUnknown`
	)

Set a RawPacket and re-construct all packet layers

Parameters

[in]	rawPacket	Raw packet to set
[in]	freeRawPacket	A flag indicating if the destructor should also call the raw packet destructor or not
[in]	parseUntil	Parse the packet until it reaches this protocol. Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is UnknownProtocol which means don't take this parameter into account
[in]	parseUntilLayer	Parse the packet until certain layer in OSI model. Can be useful for cases when you need to parse only up to a certain layer and want to avoid the performance impact and memory consumption of parsing the whole packet. Default value is OsiModelLayerUnknown which means don't take this parameter into account

◆ toString()

std::string pcpp::Packet::toString ( bool timeAsLocalTime = true )

Each layer can print a string representation of the layer most important data using Layer::toString(). This method aggregates this string from all layers and print it to a complete string containing all packet's relevant data

Parameters

[in] timeAsLocalTime Print time as local time or GMT. Default (true value) is local time, for GMT set to false

Returns: A string containing most relevant data from all layers (looks like the packet description in Wireshark)

◆ toStringList()

void pcpp::Packet::toStringList	(	std::vector< std::string > &	result,
		bool	timeAsLocalTime = `true`
	)		const

Similar to toString(), but instead of one string it outputs a list of strings, one string for every layer

Parameters

[out]	result	A string vector that will contain all strings
[in]	timeAsLocalTime	Print time as local time or GMT. Default (true value) is local time, for GMT set to false

Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ Packet() [1/5]

◆ Packet() [2/5]

◆ Packet() [3/5]

◆ Packet() [4/5]

◆ ~Packet()

◆ Packet() [5/5]

Member Function Documentation

◆ addLayer()

◆ computeCalculateFields()

◆ detachLayer() [1/2]

◆ detachLayer() [2/2]

◆ getFirstLayer()

◆ getLastLayer()

◆ getLayerOfType() [1/2]

◆ getLayerOfType() [2/2]

◆ getNextLayerOfType()

◆ getPrevLayerOfType()

◆ getRawPacket()

◆ getRawPacketReadOnly()

◆ insertLayer()

◆ isPacketOfType()

◆ operator=()

◆ removeAllLayersAfter()

◆ removeFirstLayer()

◆ removeLastLayer()

◆ removeLayer()

◆ setRawPacket()

◆ toString()

◆ toStringList()