Hello! I'm trying to do L2TP packet parser and want to do something like this for pasring nested data in l2tp payload:
const u_char *l2tp_tunnel_payload = p + h->extended_hdr.parsed_pkt.offset.l4_offset + 4 + 4; struct pfring_pkthdr l2tp_header; memset(&l2tp_header, 0, sizeof(l2tp_header)); pfring_parse_pkt((u_char*)l2tp_tunnel_payload, &l2tp_header, 4, 0, 0); But parser did not work correctly with abosultely righ shift and I tried to parse packet already parsed by kernel for checking it: const u_char *l2tp_tunnel_payload = p; struct pfring_pkthdr l2tp_header; memset(&l2tp_header, 0, sizeof(l2tp_header)); pfring_parse_pkt((u_char*)l2tp_tunnel_payload, &l2tp_header, 4, 0, 0); I printed result of kernel parse: 2014-12-09 14:12:09,117 [INFO] [00:1F:12:84:E2:E7 -> 90:E2:BA:49:85:C8] [IPv4][5.254.105.102:0 -> 159.253.17.251:0] [l3_proto=115][hash=2784721876][tos=32][tcp_seq_num=0] [caplen=128][len=146][parsed_header_len=0][eth_offset=-14][l3_offset=14][l4_offset=34][payload_offset=0] And result of second call: 2014-12-09 14:12:09,117 [INFO] [00:1F:12:84:E2:E7 -> 90:E2:BA:49:85:C8] [IPv4][0.0.0.0:0 -> 0.0.0.0:0] [l3_proto=0][hash=0][tos=0][tcp_seq_num=0] [caplen=0][len=0][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=0][payload_offset=0] As you can see second call on same packet with zeroed struct pfring_pkthdr struct produces completely incorrect data. How I should initilize struct pfring_pkthdr correctly for pfring_parse_pkt? -- Sincerely yours, Pavel Odintsov _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
