mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 18:48:20 +00:00
Add SkipAnalyzer.
This is WIP: The test case would require a new pcap or the possibility to overwrite analyzer mappings. The CustomEncapsulationSkip method and the corresponding options need to be removed.
This commit is contained in:
parent
6f6e5b4df0
commit
fc814bd7e2
11 changed files with 113 additions and 1 deletions
27
src/packet_analysis/protocol/skip/Skip.h
Normal file
27
src/packet_analysis/protocol/skip/Skip.h
Normal file
|
@ -0,0 +1,27 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <packet_analysis/Analyzer.h>
|
||||
#include <packet_analysis/Component.h>
|
||||
|
||||
namespace zeek::packet_analysis::Skip {
|
||||
|
||||
class SkipAnalyzer : public Analyzer {
|
||||
public:
|
||||
SkipAnalyzer();
|
||||
~SkipAnalyzer() override = default;
|
||||
|
||||
void Initialize() override;
|
||||
AnalyzerResult Analyze(Packet* packet, const uint8_t*& data) override;
|
||||
|
||||
static zeek::packet_analysis::AnalyzerPtr Instantiate()
|
||||
{
|
||||
return std::make_shared<SkipAnalyzer>();
|
||||
}
|
||||
|
||||
private:
|
||||
bro_uint_t skip_bytes = 0;
|
||||
};
|
||||
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue