Commit 3f542e05 authored by Yann Garcia's avatar Yann Garcia
Browse files

Add Linux cooked capture layer processing

parent e477d327

ccsrc/Protocols/Pcap/pcap_offline_layer.cc

+4 −1
Original line number Diff line number Diff line
@@ -210,7 +210,10 @@ void pcap_offline_layer::receive_data(OCTETSTRING &data, params &params) { 
  loggers::get_instance().log(">>> pcap_offline_layer::receive_data: Received %d bytes", data.lengthof());



  const uint8_t *p = static_cast<const uint8_t*>(data);

  if ((*p == 0x00) && ((*(p + 1) == 0x00) || (*(p + 1) == 0x04))) { // Linux PCAP header to be skipped

  if (

        ((*p == 0x00) && (*(p + 1) == 0x04) && (*(p + 2) == 0x00) && (*(p + 3) == 0x01)) || // Linux cooked capture v1 layer

        ((*p == 0x08) && (*(p + 1) == 0x00) && (*(p + 2) == 0x00) && (*(p + 3) == 0x010)) // Linux cooked capture v2 layer

     ) {

    // It's up to the user to know the protocol (IPv4/IPv6) and the source MAC address

    loggers::get_instance().log_to_hexa("Skipping Linux PCAP header.", data);

    data = OCTETSTRING(data.lengthof() - 16, 16 + static_cast<const uint8_t*>(data));