Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add comment about packet header size and session analysis

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-09-28 09:58:32 -07:00
parent d0cc30eccd
commit 02ed03adaa
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/packet_analysis/protocol/ip/IP.cc
View file

@ -225,6 +225,12 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
data = ip_hdr->Payload();
len -= ip_hdr_len;
// Session analysis assumes that the header size stored in the packet does not include the IP header
// size. There are two reasons for this: 1) Packet::ToRawPktHdrVal() wants to look at the IP header for
// reporting, and 2) The VXLAN analyzer uses the header position to create the next packet in the tunnel
// chain. Once the TCP/UDP work is done and the VXLAN analyzer can move into packet analysis, this can
// change, but for now we leave it as it is.
bool return_val = true;
int proto = ip_hdr->NextProto();