mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 04:58:21 +00:00
adce4e604a
This is based on commit 99e6942efec5feff50523f6b2a1f5868f19ab638 from the zeek-docs repo.
23 lines
448 B
C++
23 lines
448 B
C++
bool LLCDemo::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|
{
|
|
// Rudimentary parsing of 802.2 LLC
|
|
if ( 17 >= len )
|
|
{
|
|
packet->Weird("truncated_llc_header");
|
|
return false;
|
|
}
|
|
|
|
if ( ! llc_demo_message )
|
|
return true;
|
|
|
|
auto dsap = data[14];
|
|
auto ssap = data[15];
|
|
auto control = data[16];
|
|
|
|
event_mgr.Enqueue(llc_demo_message,
|
|
val_mgr->Count(dsap),
|
|
val_mgr->Count(ssap),
|
|
val_mgr->Count(control));
|
|
|
|
return true;
|
|
}
|