io.pkts.framer

Class SllFramer

java.lang.Object

io.pkts.framer.SllFramer

All Implemented Interfaces:

Framer<PCapPacket,MACPacket>

public class SllFramer
extends Object
implements Framer<PCapPacket,MACPacket>

SLL is the linux cooked-mode capture. http://wiki.wireshark.org/SLL Also, check out the source file pcap/sll.h in libpcap. it contains the structure and the defined values

Author:

jonas@jonasborjesson.com

Constructor Summary

Constructors

Constructor and Description
SllFramer()

Method Summary

Modifier and Type	Method and Description
boolean	accept(Buffer buffer) (taken from pcap/sll.sh) For captures on Linux cooked sockets, we construct a fake header that includes: a 2-byte "packet type" which is one of: LINUX_SLL_HOST packet was sent to us LINUX_SLL_BROADCAST packet was broadcast LINUX_SLL_MULTICAST packet was multicast LINUX_SLL_OTHERHOST packet was sent to somebody else LINUX_SLL_OUTGOING packet was sent *by* us; a 2-byte Ethernet protocol field; a 2-byte link-layer type; a 2-byte link-layer address length; an 8-byte source link-layer address, whose actual length is specified by the previous value.
MACPacket	frame(PCapPacket parent, Buffer buffer) Ask the framer to frame the buffer into a packet.
Protocol	getProtocol()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SllFramer

public SllFramer()

Method Detail

getProtocol

public Protocol getProtocol()

Specified by:

getProtocol in interface Framer<PCapPacket,MACPacket>

Returns:

the protocol this framer is capable of framing

frame

public MACPacket frame(PCapPacket parent,
                       Buffer buffer)
                throws IOException

Ask the framer to frame the buffer into a packet. Note that the Packet has not been parsed, just framed.

Specified by:

frame in interface Framer<PCapPacket,MACPacket>

Parameters:

parent - the parent frame or null if the frame doesn't have one.

buffer - the buffer containing all the raw data

Returns:

a new frame

Throws:

IOException - in case something goes wrong when reading data from the buffer

accept

public boolean accept(Buffer buffer)
               throws IOException

(taken from pcap/sll.sh) For captures on Linux cooked sockets, we construct a fake header that includes: a 2-byte "packet type" which is one of: LINUX_SLL_HOST packet was sent to us LINUX_SLL_BROADCAST packet was broadcast LINUX_SLL_MULTICAST packet was multicast LINUX_SLL_OTHERHOST packet was sent to somebody else LINUX_SLL_OUTGOING packet was sent *by* us; a 2-byte Ethernet protocol field; a 2-byte link-layer type; a 2-byte link-layer address length; an 8-byte source link-layer address, whose actual length is specified by the previous value. All fields except for the link-layer address are in network byte order. DO NOT change the layout of this structure, or change any of the LINUX_SLL_ values below. If you must change the link-layer header for a "cooked" Linux capture, introduce a new DLT_ type (ask "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it a value that collides with a value already being used), and use the new header in captures of that type, so that programs that can handle DLT_LINUX_SLL captures will continue to handle them correctly without any change, and so that capture files with different headers can be told apart and programs that read them can dissect the packets in them. Check whether the supplied data could be framed into a frame of this type. Typically, a Framer will read a few bytes in an effort to figure out if the incoming data may be something it recognizes. E.g., a HTTP Framer could check if the first bytes match "GET", "POST", "PUT" and "DELETE" if if so assume that the payload indeed is HTTP and therefore return true. Of course, you may never really know until you actually have parsed the entire body but this method should return quick and if turns out that the data isn't what it thought, throw an exception and the framework will take care of it.

Specified by:

accept in interface Framer<PCapPacket,MACPacket>

Parameters:

buffer - the data to check whether it could be a frame of this type

Returns:

true if the data indeed could be of this framer type, false if not

Throws:

IOException