Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 02:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Refactor to make bro use a common Packet object.

Browse source 
Do a better job of parsing layer 2 and keeping track of layer 3 proto.
Add support for raw packet event, including Layer2 headers.
This commit is contained in:
Jeff Barber 2015-05-22 16:43:03 -04:00
parent 2b1cd66f17
commit 30fdc37479
34 changed files with 677 additions and 429 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/iosource/pcap/Source.cc
View file

@ -167,9 +167,8 @@ bool PcapSource::ExtractNextPacket(Packet* pkt)
return false;
}
pkt->ts = current_hdr.ts.tv_sec + double(current_hdr.ts.tv_usec) / 1e6;
pkt->hdr = &current_hdr;
pkt->data = last_data = data;
last_data = data;
pkt->Init(props.link_type, &current_hdr.ts, current_hdr.caplen, current_hdr.len, data);
if ( current_hdr.len == 0 || current_hdr.caplen == 0 )
{