From 02ed03adaa7db9be8359c389122eff7df3012c52 Mon Sep 17 00:00:00 2001 From: Tim Wojtulewicz Date: Mon, 28 Sep 2020 09:58:32 -0700 Subject: [PATCH] Add comment about packet header size and session analysis --- src/packet_analysis/protocol/ip/IP.cc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/packet_analysis/protocol/ip/IP.cc b/src/packet_analysis/protocol/ip/IP.cc index aaafa4fe28..e9055a0393 100644 --- a/src/packet_analysis/protocol/ip/IP.cc +++ b/src/packet_analysis/protocol/ip/IP.cc @@ -225,6 +225,12 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) data = ip_hdr->Payload(); len -= ip_hdr_len; + // Session analysis assumes that the header size stored in the packet does not include the IP header + // size. There are two reasons for this: 1) Packet::ToRawPktHdrVal() wants to look at the IP header for + // reporting, and 2) The VXLAN analyzer uses the header position to create the next packet in the tunnel + // chain. Once the TCP/UDP work is done and the VXLAN analyzer can move into packet analysis, this can + // change, but for now we leave it as it is. + bool return_val = true; int proto = ip_hdr->NextProto();