Add support for more link types: raw IP and null/loopback #421
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GyulyVGC
added
bug
GyulyVGC
commented
Dec 31, 2023
This was referenced Jan 1, 2024
|
@all-contributors please add @JulianSchmid for code, ideas. |
|
I've put up a pull request to add @JulianSchmid! 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this PR, analysing non-Ethernet-based network adapters resulted in failures because packets weren't correctly parsed.
This PR adds support for parsing packets that doesn't start with an Ethernet header.
Now users can analyse more network adapters of their PC, not only the Ethernet-based ones: support for raw IP frames, and null/loopback frames has been added.
Notable examples of usage that are enabled by this PR include the case of VPNs adapters (often based on TUN-like devices), and the case of the loopback interface.
Fixes #30
Related issue: JulianSchmid/etherparse#78
The strategy
Given an active
Capture, its link type is determined via pcap::Capture::get_datalink.Based on the link type value, packets will be parsed with different strategies:
RAW,IPV4, orIPV6, packets will be parsed starting from their IP headersNULLorLOOP, packets will be parsed starting from their IP headers after having verified the validity of the first 4 bytes (AF_INETorAF_INET6header)Support for other link types may be added in future PRs (see issue #422)