decode.h File Reference

#include <sys/types.h>
#include <pcap.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <net/if.h>
#include "stream.h"

Go to the source code of this file.

Defines
#define	ETHERNET_MTU   1500
#define	ETHERNET_TYPE_IP   0x0800
#define	ETHERNET_TYPE_ARP   0x0806
#define	ETHERNET_TYPE_REVARP   0x8035
#define	ETHERNET_TYPE_EAPOL   0x888e
#define	ETHERNET_TYPE_IPV6   0x86dd
#define	ETHERNET_TYPE_IPX   0x8137
#define	ETHERNET_TYPE_PPPoE_DISC   0x8863
#define	ETHERNET_TYPE_PPPoE_SESS   0x8864
#define	ETHERNET_TYPE_8021Q   0x8100
#define	ETHERNET_TYPE_LOOP   0x9000
#define	ETH_DSAP_SNA   0x08
#define	ETH_SSAP_SNA   0x00
#define	ETH_DSAP_STP   0x42
#define	ETH_SSAP_STP   0x42
#define	ETH_DSAP_IP   0xaa
#define	ETH_SSAP_IP   0xaa
#define	ETH_ORG_CODE_ETHR   0x000000
#define	ETH_ORG_CODE_CDP   0x00000c
#define	ETHERNET_HEADER_LEN   14
#define	ETHERNET_MAX_LEN_ENCAP   1518
#define	PPPOE_HEADER_LEN   20
#define	MINIMAL_TOKENRING_HEADER_LEN   22
#define	MINIMAL_IEEE80211_HEADER_LEN   10
#define	IEEE802_11_DATA_HDR_LEN   24
#define	TR_HLEN   MINIMAL_TOKENRING_HEADER_LEN
#define	TOKENRING_LLC_LEN   8
#define	SLIP_HEADER_LEN   16
#define	WLAN_TYPE_MGMT_ASREQ   0x0
#define	WLAN_TYPE_MGMT_ASRES   0x10
#define	WLAN_TYPE_MGMT_REREQ   0x20
#define	WLAN_TYPE_MGMT_RERES   0x30
#define	WLAN_TYPE_MGMT_PRREQ   0x40
#define	WLAN_TYPE_MGMT_PRRES   0x50
#define	WLAN_TYPE_MGMT_BEACON   0x80
#define	WLAN_TYPE_MGMT_ATIM   0x90
#define	WLAN_TYPE_MGMT_DIS   0xa0
#define	WLAN_TYPE_MGMT_AUTH   0xb0
#define	WLAN_TYPE_MGMT_DEAUTH   0xc0
#define	WLAN_TYPE_CONT_PS   0xa4
#define	WLAN_TYPE_CONT_RTS   0xb4
#define	WLAN_TYPE_CONT_CTS   0xc4
#define	WLAN_TYPE_CONT_ACK   0xd4
#define	WLAN_TYPE_CONT_CFE   0xe4
#define	WLAN_TYPE_CONT_CFACK   0xf4
#define	WLAN_TYPE_DATA_DATA   0x08
#define	WLAN_TYPE_DATA_DTCFACK   0x18
#define	WLAN_TYPE_DATA_DTCFPL   0x28
#define	WLAN_TYPE_DATA_DTACKPL   0x38
#define	WLAN_TYPE_DATA_NULL   0x48
#define	WLAN_TYPE_DATA_CFACK   0x58
#define	WLAN_TYPE_DATA_CFPL   0x68
#define	WLAN_TYPE_DATA_ACKPL   0x78
#define	WLAN_FLAG_TODS   0x0100
#define	WLAN_FLAG_FROMDS   0x0200
#define	WLAN_FLAG_FRAG   0x0400
#define	WLAN_FLAG_RETRY   0x0800
#define	WLAN_FLAG_PWRMGMT   0x1000
#define	WLAN_FLAG_MOREDAT   0x2000
#define	WLAN_FLAG_WEP   0x4000
#define	WLAN_FLAG_ORDER   0x8000
#define	EAPOL_TYPE_EAP   0x00
#define	EAPOL_TYPE_START   0x01
#define	EAPOL_TYPE_LOGOFF   0x02
#define	EAPOL_TYPE_KEY   0x03
#define	EAPOL_TYPE_ASF   0x04
#define	EAP_CODE_REQUEST   0x01
#define	EAP_CODE_RESPONSE   0x02
#define	EAP_CODE_SUCCESS   0x03
#define	EAP_CODE_FAILURE   0x04
#define	EAP_TYPE_IDENTITY   0x01
#define	EAP_TYPE_NOTIFY   0x02
#define	EAP_TYPE_NAK   0x03
#define	EAP_TYPE_MD5   0x04
#define	EAP_TYPE_OTP   0x05
#define	EAP_TYPE_GTC   0x06
#define	EAP_TYPE_TLS   0x0d
#define	CHDLC_HEADER_LEN   4
#define	CHDLC_ADDR_UNICAST   0x0f
#define	CHDLC_ADDR_MULTICAST   0x8f
#define	CHDLC_ADDR_BROADCAST   0xff
#define	CHDLC_CTRL_UNNUMBERED   0x03
#define	PPP_HDRLEN   sizeof(struct ppp_header)
#define	PPP_IP   0x0021
#define	PPP_VJ_COMP   0x002d
#define	PPP_VJ_UCOMP   0x002f
#define	PPP_IPX   0x002b
#define	PPP_MTU   1500
#define	NULL_HDRLEN   4
#define	ENC_HEADER_LEN   12
#define	IP_HEADER_LEN   20
#define	TCP_HEADER_LEN   20
#define	UDP_HEADER_LEN   8
#define	ICMP_HEADER_LEN   4
#define	IP_OPTMAX   40
#define	TCP_OPTLENMAX   40
#define	IP_MAXPACKET   65535
#define	TH_FIN   0x01
#define	TH_SYN   0x02
#define	TH_RST   0x04
#define	TH_PUSH   0x08
#define	TH_ACK   0x10
#define	TH_URG   0x20
#define	TH_RES2   0x40
#define	TH_RES1   0x80
#define	TH_NORESERVED   (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG)
#define	TCPOPT_EOL   0
#define	TCPOLEN_EOL   1
#define	TCPOPT_NOP   1
#define	TCPOLEN_NOP   1
#define	TCPOPT_MAXSEG   2
#define	TCPOLEN_MAXSEG   4
#define	TCPOPT_WSCALE   3
#define	TCPOLEN_WSCALE   3
#define	TCPOPT_SACKOK   4
#define	TCPOLEN_SACKOK   2
#define	TCPOPT_SACK   5
#define	TCPOPT_ECHO   6
#define	TCPOLEN_ECHO   6
#define	TCPOPT_ECHOREPLY   7
#define	TCPOLEN_ECHOREPLY   6
#define	TCPOPT_TIMESTAMP   8
#define	TCPOLEN_TIMESTAMP   10
#define	TCPOPT_PARTIAL_PERM   9
#define	TCPOLEN_PARTIAL_PERM   2
#define	TCPOPT_PARTIAL_SVC   10
#define	TCPOLEN_PARTIAL_SVC   3
#define	TCPOPT_CC   11
#define	TCPOPT_CC_NEW   12
#define	TCPOPT_CC_ECHO   13
#define	TCPOLEN_CC   6
#define	TCPOLEN_CC_NEW   6
#define	TCPOLEN_CC_ECHO   6
#define	TCPOPT_ALTCSUM   15
#define	TCPOPT_SKEETER   16
#define	TCPOPT_BUBBA   17
#define	TCPOPT_TRAILER_CSUM   18
#define	TCPOLEN_TRAILER_CSUM   3
#define	TCPOPT_MD5SIG   19
#define	TCPOLEN_MD5SIG   18
#define	TCPOPT_SCPS   20
#define	TCPOPT_SELNEGACK   21
#define	TCPOPT_RECORDBOUND   22
#define	TCPOPT_CORRUPTION   23
#define	TCPOPT_SNAP   24
#define	TCPOPT_UNASSIGNED   25
#define	TCPOPT_COMPRESSION   26
#define	TCP_OPT_TRUNC   -1
#define	TCP_OPT_BADLEN   -2
#define	TCPOLEN_TSTAMP_APPA   (TCPOLEN_TIMESTAMP+2)
#define	TCPOPT_TSTAMP_HDR   (TCPOPT_NOP<<24|TCPOPT_NOP<<16|TCPOPT_TIMESTAMP<<8|TCPOLEN_TIMESTAMP)
#define	TCP_MSS   512
#define	TCP_MAXWIN   65535
#define	TCP_MAX_WINSHIFT   14
#define	TCP_NODELAY   0x01
#define	TCP_MAXSEG   0x02
#define	SOL_TCP   6
#define	L2TP_PORT   1701
#define	DHCP_CLIENT_PORT   68
#define	DHCP_SERVER_PORT   67
#define	SNAPLEN   1514
#define	MIN_SNAPLEN   68
#define	PROMISC   1
#define	READ_TIMEOUT   500
#define	TR_ALEN   6
#define	IPARP_SAP   0xaa
#define	AC   0x10
#define	LLC_FRAME   0x40
#define	TRMTU   2000
#define	TR_RII   0x80
#define	TR_RCF_DIR_BIT   0x80
#define	TR_RCF_LEN_MASK   0x1f00
#define	TR_RCF_BROADCAST   0x8000
#define	TR_RCF_LIMITED_BROADCAST   0xC000
#define	TR_RCF_FRAME2K   0x20
#define	TR_RCF_BROADCAST_MASK   0xC000
#define	FDDI_ALLC_LEN   13
#define	FDDI_ALEN   6
#define	FDDI_MIN_HLEN   (FDDI_ALLC_LEN + 3)
#define	FDDI_DSAP_SNA   0x08
#define	FDDI_SSAP_SNA   0x00
#define	FDDI_DSAP_STP   0x42
#define	FDDI_SSAP_STP   0x42
#define	FDDI_DSAP_IP   0xaa
#define	FDDI_SSAP_IP   0xaa
#define	FDDI_ORG_CODE_ETHR   0x000000
#define	FDDI_ORG_CODE_CDP   0x00000c
#define	ETHERNET_TYPE_CDP   0x2000
#define	ARPOP_REQUEST   1
#define	ARPOP_REPLY   2
#define	ARPOP_RREQUEST   3
#define	ARPOP_RREPLY   4
#define	PPPoE_CODE_SESS   0x00
#define	PPPoE_CODE_PADI   0x09
#define	PPPoE_CODE_PADO   0x07
#define	PPPoE_CODE_PADR   0x19
#define	PPPoE_CODE_PADS   0x65
#define	PPPoE_CODE_PADT   0xa7
#define	PPPoE_TAG_END_OF_LIST   0x0000
#define	PPPoE_TAG_SERVICE_NAME   0x0101
#define	PPPoE_TAG_AC_NAME   0x0102
#define	PPPoE_TAG_HOST_UNIQ   0x0103
#define	PPPoE_TAG_AC_COOKIE   0x0104
#define	PPPoE_TAG_VENDOR_SPECIFIC   0x0105
#define	PPPoE_TAG_RELAY_SESSION_ID   0x0110
#define	PPPoE_TAG_SERVICE_NAME_ERROR   0x0201
#define	PPPoE_TAG_AC_SYSTEM_ERROR   0x0202
#define	PPPoE_TAG_GENERIC_ERROR   0x0203
#define	ICMP_ECHOREPLY   0
#define	ICMP_DEST_UNREACH   3
#define	ICMP_SOURCE_QUENCH   4
#define	ICMP_REDIRECT   5
#define	ICMP_ECHO   8
#define	ICMP_ROUTER_ADVERTISE   9
#define	ICMP_ROUTER_SOLICIT   10
#define	ICMP_TIME_EXCEEDED   11
#define	ICMP_PARAMETERPROB   12
#define	ICMP_TIMESTAMP   13
#define	ICMP_TIMESTAMPREPLY   14
#define	ICMP_INFO_REQUEST   15
#define	ICMP_INFO_REPLY   16
#define	ICMP_ADDRESS   17
#define	ICMP_ADDRESSREPLY   18
#define	NR_ICMP_TYPES   18
#define	ICMP_NET_UNREACH   0
#define	ICMP_HOST_UNREACH   1
#define	ICMP_PROT_UNREACH   2
#define	ICMP_PORT_UNREACH   3
#define	ICMP_FRAG_NEEDED   4
#define	ICMP_SR_FAILED   5
#define	ICMP_NET_UNKNOWN   6
#define	ICMP_HOST_UNKNOWN   7
#define	ICMP_HOST_ISOLATED   8
#define	ICMP_PKT_FILTERED_NET   9
#define	ICMP_PKT_FILTERED_HOST   10
#define	ICMP_NET_UNR_TOS   11
#define	ICMP_HOST_UNR_TOS   12
#define	ICMP_PKT_FILTERED   13
#define	ICMP_PREC_VIOLATION   14
#define	ICMP_PREC_CUTOFF   15
#define	NR_ICMP_UNREACH   15
#define	ICMP_REDIR_NET   0
#define	ICMP_REDIR_HOST   1
#define	ICMP_REDIR_TOS_NET   2
#define	ICMP_REDIR_TOS_HOST   3
#define	ICMP_TIMEOUT_TRANSIT   0
#define	ICMP_TIMEOUT_REASSY   1
#define	ICMP_PARAM_BADIPHDR   0
#define	ICMP_PARAM_OPTMISSING   1
#define	ICMP_PARAM_BAD_LENGTH   2
#define	IPOPT_EOL   0x00
#define	IPOPT_NOP   0x01
#define	IPOPT_RR   0x07
#define	IPOPT_RTRALT   0x14
#define	IPOPT_TS   0x44
#define	IPOPT_SECURITY   0x82
#define	IPOPT_LSRR   0x83
#define	IPOPT_LSRR_E   0x84
#define	IPOPT_SATID   0x88
#define	IPOPT_SSRR   0x89
#define	TOPT_EOL   0x00
#define	TOPT_NOP   0x01
#define	TOPT_MSS   0x02
#define	TOPT_WS   0x03
#define	TOPT_TS   0x08
#define	TCPOPT_CCNEW   12
#define	TCPOPT_CCECHO   13
#define	EXTRACT_16BITS(p)   ((u_short) ntohs (*(u_short *)(p)))
#define	EXTRACT_32BITS(p)   ((u_int32_t) ntohl (*(u_int32_t *)(p)))
#define	PKT_REBUILT_FRAG   0x00000001
#define	PKT_REBUILT_STREAM   0x00000002
#define	PKT_STREAM_UNEST_UNI   0x00000004
#define	PKT_STREAM_UNEST_BI   0x00000008
#define	PKT_STREAM_EST   0x00000010
#define	PKT_ECN   0x00000020
#define	PKT_FROM_SERVER   0x00000040
#define	PKT_FROM_CLIENT   0x00000080
#define	PKT_HTTP_DECODE   0x00000100
#define	PKT_FRAG_ALERTED   0x00000200
#define	PKT_STREAM_INSERT   0x00000400
#define	PKT_ALT_DECODE   0x00000800
#define	PKT_STREAM_TWH   0x00001000
#define	PKT_IGNORE_PORT   0x00002000
#define	PKT_INLINE_DROP   0x20000000
#define	PKT_OBFUSCATED   0x40000000
#define	PKT_LOGGED   0x80000000
#define	TRH_MR_BCAST(trhmr)   ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0xe000) >> 13)
#define	TRH_MR_LEN(trhmr)   ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x1F00) >> 8)
#define	TRH_MR_DIR(trhmr)   ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0080) >> 8)
#define	TRH_MR_LF(trhmr)   ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0070) >> 7)
#define	TRH_MR_RES(trhmr)   ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x000F))
#define	SLL_HDR_LEN   16
#define	SLL_ADDRLEN   8
#define	OLDPFLOG_HDRLEN   sizeof(struct _OldPflog_hdr)
#define	PFLOG_HDRLEN   sizeof(struct _Pflog_hdr)
#define	LINUX_SLL_HOST   0
#define	LINUX_SLL_BROADCAST   1
#define	LINUX_SLL_MULTICAST   2
#define	LINUX_SLL_OTHERHOST   3
#define	LINUX_SLL_OUTGOING   4
#define	LINUX_SLL_P_802_3   0x0001
#define	LINUX_SLL_P_802_2   0x0004
#define	VTH_PRIORITY(vh)   ((ntohs((vh)->vth_pri_cfi_vlan) & 0xe000) >> 13)
#define	VTH_CFI(vh)   ((ntohs((vh)->vth_pri_cfi_vlan) & 0x0100) >> 12)
#define	VTH_VLAN(vh)   ((ntohs((vh)->vth_pri_cfi_vlan) & 0x0FFF))
#define	IP_VER(iph)   (((iph)->ip_verhl & 0xf0) >> 4)
#define	IP_HLEN(iph)   ((iph)->ip_verhl & 0x0f)
#define	SET_IP_VER(iph, value)   ((iph)->ip_verhl = (((iph)->ip_verhl & 0x0f) | (value << 4)))
#define	SET_IP_HLEN(iph, value)   ((iph)->ip_verhl = (((iph)->ip_verhl & 0xf0) | (value & 0x0f)))
#define	TCP_OFFSET(tcph)   (((tcph)->th_offx2 & 0xf0) >> 4)
#define	TCP_X2(tcph)   ((tcph)->th_offx2 & 0x0f)
#define	SET_TCP_OFFSET(tcph, value)   ((tcph)->th_offx2 = (((tcph)->th_offx2 & 0x0f) | (value << 4)))
#define	SET_TCP_X2(tcph, value)   ((tcph)->th_offx2 = (((tcph)->th_offx2 & 0xf0) | (value & 0x0f)))
#define	s_icmp_pptr   icmp_hun.pptr
#define	s_icmp_gwaddr   icmp_hun.gwaddr
#define	s_icmp_id   icmp_hun.idseq.id
#define	s_icmp_seq   icmp_hun.idseq.seq
#define	s_icmp_void   icmp_hun.sih_void
#define	s_icmp_pmvoid   icmp_hun.pmtu.ipm_void
#define	s_icmp_nextmtu   icmp_hun.pmtu.nextmtu
#define	s_icmp_num_addrs   icmp_hun.rtradv.num_addrs
#define	s_icmp_wpa   icmp_hun.rtradv.wpa
#define	s_icmp_lifetime   icmp_hun.rtradv.lifetime
#define	s_icmp_otime   icmp_dun.ts.otime
#define	s_icmp_rtime   icmp_dun.ts.rtime
#define	s_icmp_ttime   icmp_dun.ts.ttime
#define	s_icmp_ip   icmp_dun.ih_ip
#define	s_icmp_radv   icmp_dun.radv
#define	s_icmp_mask   icmp_dun.mask
#define	s_icmp_data   icmp_dun.data
#define	DECODE_BLEN   65535
#define	URI_COUNT   5
#define	HTTPURI_PIPELINE_REQ   0x01
#define	DECODE_CLASS   25
#define	ALERTMSG_LENGTH   256
Typedefs
typedef _Trh_llc	Trh_llc
typedef _Trh_mr	Trh_mr
typedef _Trh_hdr	Trh_hdr
typedef _Fddi_hdr	Fddi_hdr
typedef _Fddi_llc_saps	Fddi_llc_saps
typedef _Fddi_llc_sna	Fddi_llc_sna
typedef _Fddi_llc_other	Fddi_llc_other
typedef _Fddi_llc_iparp	Fddi_llc_iparp
typedef _SLLHdr	SLLHdr
typedef _OldPflog_hdr	OldPflogHdr
typedef _Pflog_hdr	PflogHdr
typedef _VlanTagHdr	VlanTagHdr
typedef _EthLlc	EthLlc
typedef _EthLlcOther	EthLlcOther
typedef _EtherHdr	EtherHdr
typedef _WifiHdr	WifiHdr
typedef _IPHdr	IPHdr
typedef _TCPHdr	TCPHdr
typedef _UDPHdr	UDPHdr
typedef _ICMPHdr	ICMPHdr
typedef _ARPHdr	ARPHdr
typedef _EtherARP	EtherARP
typedef _EtherEapol	EtherEapol
typedef _EAPHdr	EAPHdr
typedef _EapolKey	EapolKey
typedef _Options	Options
typedef _PPPoEHdr	PPPoEHdr
typedef _PPPoE_Tag	PPPoE_Tag
typedef _HttpUri	HttpUri
typedef _Packet	Packet
typedef s_pseudoheader	PSEUDO_HDR
typedef _DecoderFlags	DecoderFlags
typedef _PortList	PortList
Functions
void	InitDecoderFlags (void)
void	DecodeTRPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeFDDIPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeLinuxSLLPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeEthPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeIEEE80211Pkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeVlan (u_int8_t *, const u_int32_t, Packet *)
void	DecodePppPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodePppSerialPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodePppPktEncapsulated (Packet *, const u_int32_t, u_int8_t *)
void	DecodeSlipPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeNullPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeRawPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeI4LRawIPPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeI4LCiscoIPPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeChdlcPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodePflog (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeOldPflog (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeIP (u_int8_t *, const u_int32_t, Packet *)
void	DecodeARP (u_int8_t *, u_int32_t, Packet *)
void	DecodeEapol (u_int8_t *, u_int32_t, Packet *)
void	DecodeEapolKey (u_int8_t *, u_int32_t, Packet *)
void	DecodeIPV6 (u_int8_t *, u_int32_t)
void	DecodeIPX (u_int8_t *, u_int32_t)
void	DecodeEthLoopback (u_int8_t *, u_int32_t)
void	DecodeTCP (u_int8_t *, const u_int32_t, Packet *)
void	DecodeUDP (u_int8_t *, const u_int32_t, Packet *)
void	DecodeEAP (u_int8_t *, const u_int32_t, Packet *)
void	DecodeICMP (u_int8_t *, const u_int32_t, Packet *)
void	DecodeIPOptions (u_int8_t *, u_int32_t, Packet *)
void	DecodeTCPOptions (u_int8_t *, u_int32_t, Packet *)
void	DecodePPPoEPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)
void	DecodeEncPkt (Packet *, struct pcap_pkthdr *, u_int8_t *)

---

Define Documentation

#define AC   0x10

Definition at line 339 of file decode.h.

#define ALERTMSG_LENGTH   256

Definition at line 1189 of file decode.h. Referenced by AlertUnixSock().

#define ARPOP_REPLY   2

Definition at line 372 of file decode.h. Referenced by DetectARPattacks(), and PrintArpHeader().

#define ARPOP_REQUEST   1

Definition at line 371 of file decode.h. Referenced by DetectARPattacks(), and PrintArpHeader().

#define ARPOP_RREPLY   4

Definition at line 374 of file decode.h. Referenced by PrintArpHeader().

#define ARPOP_RREQUEST   3

Definition at line 373 of file decode.h. Referenced by PrintArpHeader().

#define CHDLC_ADDR_BROADCAST   0xff

Definition at line 149 of file decode.h. Referenced by DecodePppPkt(), and DecodePppSerialPkt().

#define CHDLC_ADDR_MULTICAST   0x8f

Definition at line 148 of file decode.h. Referenced by DecodeChdlcPkt().

#define CHDLC_ADDR_UNICAST   0x0f

Definition at line 147 of file decode.h. Referenced by DecodeChdlcPkt().

#define CHDLC_CTRL_UNNUMBERED   0x03

Definition at line 150 of file decode.h. Referenced by DecodePppPkt(), and DecodePppSerialPkt().

#define CHDLC_HEADER_LEN   4

Definition at line 146 of file decode.h. Referenced by DecodeChdlcPkt().

#define DECODE_BLEN   65535

Definition at line 1060 of file decode.h. Referenced by NormalizeTelnet().

#define DECODE_CLASS   25

Definition at line 1171 of file decode.h. Referenced by DecodeARP(), DecodeEAP(), DecodeEapol(), DecodeEapolKey(), DecodeICMP(), DecodeIEEE80211Pkt(), DecodeIP(), DecodeIPOptions(), DecodePPPoEPkt(), DecodeTCP(), DecodeTCPOptions(), DecodeTRPkt(), DecodeUDP(), DecodeVlan(), and IPHdrTests().

#define DHCP_CLIENT_PORT   68

Definition at line 321 of file decode.h.

#define DHCP_SERVER_PORT   67

Definition at line 322 of file decode.h.

#define EAP_CODE_FAILURE   0x04

Definition at line 135 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_CODE_REQUEST   0x01

Definition at line 132 of file decode.h. Referenced by DecodeEAP(), and PrintEAPHeader().

#define EAP_CODE_RESPONSE   0x02

Definition at line 133 of file decode.h. Referenced by DecodeEAP(), and PrintEAPHeader().

#define EAP_CODE_SUCCESS   0x03

Definition at line 134 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_TYPE_GTC   0x06

Definition at line 142 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_TYPE_IDENTITY   0x01

Definition at line 137 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_TYPE_MD5   0x04

Definition at line 140 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_TYPE_NAK   0x03

Definition at line 139 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_TYPE_NOTIFY   0x02

Definition at line 138 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_TYPE_OTP   0x05

Definition at line 141 of file decode.h. Referenced by PrintEAPHeader().

#define EAP_TYPE_TLS   0x0d

Definition at line 143 of file decode.h. Referenced by PrintEAPHeader().

#define EAPOL_TYPE_ASF   0x04

Definition at line 129 of file decode.h. Referenced by PrintEapolHeader().

#define EAPOL_TYPE_EAP   0x00

Definition at line 125 of file decode.h. Referenced by DecodeEapol(), PrintEapolHeader(), and PrintEapolPkt().

#define EAPOL_TYPE_KEY   0x03

Definition at line 128 of file decode.h. Referenced by DecodeEapol(), PrintEapolHeader(), and PrintEapolPkt().

#define EAPOL_TYPE_LOGOFF   0x02

Definition at line 127 of file decode.h. Referenced by PrintEapolHeader().

#define EAPOL_TYPE_START   0x01

Definition at line 126 of file decode.h. Referenced by PrintEapolHeader().

#define ENC_HEADER_LEN   12

Definition at line 187 of file decode.h.

#define ETH_DSAP_IP   0xaa

Definition at line 67 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and DecodeVlan().

#define ETH_DSAP_SNA   0x08

Definition at line 63 of file decode.h.

#define ETH_DSAP_STP   0x42

Definition at line 65 of file decode.h.

#define ETH_ORG_CODE_CDP   0x00000c

Definition at line 71 of file decode.h.

#define ETH_ORG_CODE_ETHR   0x000000

Definition at line 70 of file decode.h.

#define ETH_SSAP_IP   0xaa

Definition at line 68 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and DecodeVlan().

#define ETH_SSAP_SNA   0x00

Definition at line 64 of file decode.h.

#define ETH_SSAP_STP   0x42

Definition at line 66 of file decode.h.

#define ETHERNET_HEADER_LEN   14

Definition at line 73 of file decode.h. Referenced by BuildPacket(), DecodeEthPkt(), flowps_init_pkt(), flowps_mkpacket(), Frag3Rebuild(), InitFakePkt(), InitStream4Pkt(), MakePortscanPkt(), PortscanPacketInit(), and RebuildFrag().

#define ETHERNET_MAX_LEN_ENCAP   1518

Definition at line 74 of file decode.h. Referenced by DecodeVlan().

#define ETHERNET_MTU   1500

Definition at line 51 of file decode.h.

#define ETHERNET_TYPE_8021Q   0x8100

Definition at line 60 of file decode.h. Referenced by DecodeEthPkt(), DecodeFDDIPkt(), DecodeIEEE80211Pkt(), and DecodeTRPkt().

#define ETHERNET_TYPE_ARP   0x0806

Definition at line 53 of file decode.h. Referenced by DecodeEthPkt(), DecodeFDDIPkt(), DecodeIEEE80211Pkt(), DecodeTRPkt(), DecodeVlan(), and WhichProto().

#define ETHERNET_TYPE_CDP   0x2000

Definition at line 368 of file decode.h.

#define ETHERNET_TYPE_EAPOL   0x888e

Definition at line 55 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define ETHERNET_TYPE_IP   0x0800

Definition at line 52 of file decode.h. Referenced by DecodeChdlcPkt(), DecodeEthPkt(), DecodeFDDIPkt(), DecodeIEEE80211Pkt(), DecodeTRPkt(), DecodeVlan(), DetectARPattacks(), PrintArpHeader(), ProcessHeadNode(), and WhichProto().

#define ETHERNET_TYPE_IPV6   0x86dd

Definition at line 56 of file decode.h. Referenced by DecodeEthPkt().

#define ETHERNET_TYPE_IPX   0x8137

Definition at line 57 of file decode.h. Referenced by DecodeEthPkt().

#define ETHERNET_TYPE_LOOP   0x9000

Definition at line 61 of file decode.h. Referenced by DecodeEthPkt().

#define ETHERNET_TYPE_PPPoE_DISC   0x8863

Definition at line 58 of file decode.h. Referenced by DecodeEthPkt(), and DecodePPPoEPkt().

#define ETHERNET_TYPE_PPPoE_SESS   0x8864

Definition at line 59 of file decode.h. Referenced by DecodeEthPkt(), and DecodePPPoEPkt().

#define ETHERNET_TYPE_REVARP   0x8035

Definition at line 54 of file decode.h. Referenced by DecodeEthPkt(), DecodeFDDIPkt(), DecodeIEEE80211Pkt(), DecodeTRPkt(), and DecodeVlan().

#define EXTRACT_16BITS (  p   )     ((u_short) ntohs (*(u_short *)(p)))

Definition at line 523 of file decode.h. Referenced by PrintTcpOptions().

#define EXTRACT_32BITS (  p   )     ((u_int32_t) ntohl (*(u_int32_t *)(p)))

Definition at line 535 of file decode.h. Referenced by GetTcpTimestamp(), and PrintTcpOptions().

#define FDDI_ALEN   6

Definition at line 354 of file decode.h.

#define FDDI_ALLC_LEN   13

Definition at line 353 of file decode.h.

#define FDDI_DSAP_IP   0xaa

Definition at line 361 of file decode.h. Referenced by DecodeFDDIPkt().

#define FDDI_DSAP_SNA   0x08

Definition at line 357 of file decode.h. Referenced by DecodeFDDIPkt().

#define FDDI_DSAP_STP   0x42

Definition at line 359 of file decode.h.

#define FDDI_MIN_HLEN   (FDDI_ALLC_LEN + 3)

Definition at line 355 of file decode.h.

#define FDDI_ORG_CODE_CDP   0x00000c

Definition at line 365 of file decode.h.

#define FDDI_ORG_CODE_ETHR   0x000000

Definition at line 364 of file decode.h.

#define FDDI_SSAP_IP   0xaa

Definition at line 362 of file decode.h. Referenced by DecodeFDDIPkt().

#define FDDI_SSAP_SNA   0x00

Definition at line 358 of file decode.h. Referenced by DecodeFDDIPkt().

#define FDDI_SSAP_STP   0x42

Definition at line 360 of file decode.h.

#define HTTPURI_PIPELINE_REQ   0x01

Definition at line 1065 of file decode.h. Referenced by fpEvalHeaderSW(), and SnortHttpInspect().

#define ICMP_ADDRESS   17

Definition at line 410 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), PrintICMPHeader(), and ps_tracker_update_icmp().

#define ICMP_ADDRESSREPLY   18

Definition at line 411 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), and PrintICMPHeader().

#define ICMP_DEST_UNREACH   3

Definition at line 398 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), PrintICMPHeader(), ps_filter_ignore(), ps_get_proto_index(), ps_tracker_update_icmp(), ps_tracker_update_ip(), and ps_tracker_update_udp().

#define ICMP_ECHO   8

Definition at line 401 of file decode.h.

#define ICMP_ECHOREPLY   0

Definition at line 397 of file decode.h.

#define ICMP_FRAG_NEEDED   4

Definition at line 419 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_HEADER_LEN   4

Definition at line 193 of file decode.h. Referenced by DecodeICMP().

#define ICMP_HOST_ISOLATED   8

Definition at line 423 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_HOST_UNKNOWN   7

Definition at line 422 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_HOST_UNR_TOS   12

Definition at line 427 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_HOST_UNREACH   1

Definition at line 416 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_INFO_REPLY   16

Definition at line 409 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), and PrintICMPHeader().

#define ICMP_INFO_REQUEST   15

Definition at line 408 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), PrintICMPHeader(), and ps_tracker_update_icmp().

#define ICMP_NET_UNKNOWN   6

Definition at line 421 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_NET_UNR_TOS   11

Definition at line 426 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_NET_UNREACH   0

Definition at line 415 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_PARAM_BAD_LENGTH   2

Definition at line 444 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_PARAM_BADIPHDR   0

Definition at line 442 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_PARAM_OPTMISSING   1

Definition at line 443 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_PARAMETERPROB   12

Definition at line 405 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), and PrintICMPHeader().

#define ICMP_PKT_FILTERED   13

Definition at line 428 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_PKT_FILTERED_HOST   10

Definition at line 425 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_PKT_FILTERED_NET   9

Definition at line 424 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_PORT_UNREACH   3

Definition at line 418 of file decode.h. Referenced by IcmpFileName(), PrintICMPHeader(), ps_get_proto_index(), and ps_tracker_update_udp().

#define ICMP_PREC_CUTOFF   15

Definition at line 430 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_PREC_VIOLATION   14

Definition at line 429 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_PROT_UNREACH   2

Definition at line 417 of file decode.h. Referenced by IcmpFileName(), PrintICMPHeader(), ps_get_proto_index(), and ps_tracker_update_ip().

#define ICMP_REDIR_HOST   1

Definition at line 435 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_REDIR_NET   0

Definition at line 434 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_REDIR_TOS_HOST   3

Definition at line 437 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_REDIR_TOS_NET   2

Definition at line 436 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_REDIRECT   5

Definition at line 400 of file decode.h.

#define ICMP_ROUTER_ADVERTISE   9

Definition at line 402 of file decode.h. Referenced by DecodeICMP(), and PrintICMPHeader().

#define ICMP_ROUTER_SOLICIT   10

Definition at line 403 of file decode.h. Referenced by DecodeICMP(), and PrintICMPHeader().

#define ICMP_SOURCE_QUENCH   4

Definition at line 399 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), and PrintICMPHeader().

#define ICMP_SR_FAILED   5

Definition at line 420 of file decode.h. Referenced by IcmpFileName(), and PrintICMPHeader().

#define ICMP_TIME_EXCEEDED   11

Definition at line 404 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), and PrintICMPHeader().

#define ICMP_TIMEOUT_REASSY   1

Definition at line 440 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_TIMEOUT_TRANSIT   0

Definition at line 439 of file decode.h. Referenced by PrintICMPHeader().

#define ICMP_TIMESTAMP   13

Definition at line 406 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), PrintICMPHeader(), and ps_tracker_update_icmp().

#define ICMP_TIMESTAMPREPLY   14

Definition at line 407 of file decode.h. Referenced by DecodeICMP(), IcmpFileName(), and PrintICMPHeader().

#define IEEE802_11_DATA_HDR_LEN   24

Definition at line 78 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define IP_HEADER_LEN   20

Definition at line 190 of file decode.h. Referenced by BuildPacket(), CheckFragOffset(), DecodeIP(), DecodeIPOnly(), DecodePppPktEncapsulated(), flowps_mkpacket(), InitFakePkt(), and InitStream4Pkt().

#define IP_HLEN (  iph   )     ((iph)->ip_verhl & 0x0f)

Definition at line 832 of file decode.h. Referenced by Database(), DecodeIP(), DecodeIPOnly(), DecodeUDP(), Frag3CheckFirstLast(), Frag3Insert(), Frag3NewTracker(), Frag3Rebuild(), MakePortscanPkt(), PayloadReplace(), PrintICMPHeader(), PrintIPHeader(), PrintIPPkt(), and RealAlertCSV().

#define IP_MAXPACKET   65535

Definition at line 199 of file decode.h. Referenced by flowps_init_pkt(), Frag3Insert(), Frag3Rebuild(), InitFakePkt(), InitStream4Pkt(), MakeOpenPortInfo(), MakeProtoInfo(), PortscanPacketInit(), and UnifiedLogData().

#define IP_OPTMAX   40

Definition at line 195 of file decode.h. Referenced by Frag3HandleIPOptions().

#define IP_VER (  iph   )     (((iph)->ip_verhl & 0xf0) >> 4)

Definition at line 831 of file decode.h. Referenced by Database(), DecodeIP(), and DecodeIPOnly().

#define IPARP_SAP   0xaa

Definition at line 337 of file decode.h. Referenced by DecodeTRPkt().

#define IPOPT_EOL   0x00

Definition at line 448 of file decode.h. Referenced by DecodeIPOptions(), ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_LSRR   0x83

Definition at line 472 of file decode.h. Referenced by ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_LSRR_E   0x84

Definition at line 476 of file decode.h. Referenced by ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_NOP   0x01

Definition at line 452 of file decode.h. Referenced by DecodeIPOptions(), ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_RR   0x07

Definition at line 456 of file decode.h. Referenced by ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_RTRALT   0x14

Definition at line 460 of file decode.h. Referenced by DecodeIPOptions(), and PrintIpOptions().

#define IPOPT_SATID   0x88

Definition at line 480 of file decode.h. Referenced by ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_SECURITY   0x82

Definition at line 468 of file decode.h. Referenced by ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_SSRR   0x89

Definition at line 484 of file decode.h. Referenced by ParseIpOptionData(), and PrintIpOptions().

#define IPOPT_TS   0x44

Definition at line 464 of file decode.h. Referenced by ParseIpOptionData(), and PrintIpOptions().

#define L2TP_PORT   1701

Definition at line 320 of file decode.h.

#define LINUX_SLL_BROADCAST   1

Definition at line 746 of file decode.h. Referenced by PrintSLLHeader().

#define LINUX_SLL_HOST   0

Definition at line 745 of file decode.h. Referenced by PrintSLLHeader().

#define LINUX_SLL_MULTICAST   2

Definition at line 747 of file decode.h. Referenced by PrintSLLHeader().

#define LINUX_SLL_OTHERHOST   3

Definition at line 748 of file decode.h. Referenced by PrintSLLHeader().

#define LINUX_SLL_OUTGOING   4

Definition at line 749 of file decode.h. Referenced by PrintSLLHeader().

#define LINUX_SLL_P_802_2   0x0004

Definition at line 754 of file decode.h.

#define LINUX_SLL_P_802_3   0x0001

Definition at line 753 of file decode.h.

#define LLC_FRAME   0x40

Definition at line 340 of file decode.h.

#define MIN_SNAPLEN   68

Definition at line 331 of file decode.h. Referenced by OpenPcap().

#define MINIMAL_IEEE80211_HEADER_LEN   10

Definition at line 77 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define MINIMAL_TOKENRING_HEADER_LEN   22

Definition at line 76 of file decode.h.

#define NR_ICMP_TYPES   18

Definition at line 412 of file decode.h.

#define NR_ICMP_UNREACH   15

Definition at line 431 of file decode.h.

#define NULL_HDRLEN   4

Definition at line 179 of file decode.h. Referenced by DecodeNullPkt().

#define OLDPFLOG_HDRLEN   sizeof(struct _OldPflog_hdr)

Definition at line 718 of file decode.h. Referenced by DecodeOldPflog().

#define PFLOG_HDRLEN   sizeof(struct _Pflog_hdr)

Definition at line 739 of file decode.h. Referenced by DecodePflog().

#define PKT_ALT_DECODE   0x00000800

Definition at line 560 of file decode.h. Referenced by ByteJump(), ByteTest(), CheckANDPatternMatch(), CheckORPatternMatch(), fpEvalHeaderSW(), FTPBounce(), IsDataAt(), NormalizeTelnet(), and SnortPcre().

#define PKT_ECN   0x00000020

Definition at line 551 of file decode.h. Referenced by CreateNewSession().

#define PKT_FRAG_ALERTED   0x00000200

Definition at line 557 of file decode.h. Referenced by Frag2Defrag(), and InsertFrag().

#define PKT_FROM_CLIENT   0x00000080

Definition at line 554 of file decode.h. Referenced by BuildPacket(), CheckFromClient(), CheckFromServer(), ReassembleStream4(), and SetSiInput().

#define PKT_FROM_SERVER   0x00000040

Definition at line 552 of file decode.h. Referenced by BuildPacket(), CheckFromClient(), CheckFromServer(), PreprocRpcDecode(), ps_filter_ignore(), ps_tracker_update_tcp(), ReassembleStream4(), and SetSiInput().

#define PKT_HTTP_DECODE   0x00000100

Definition at line 556 of file decode.h. Referenced by SnortHttpInspect().

#define PKT_IGNORE_PORT   0x00002000

Definition at line 564 of file decode.h. Referenced by DecodeTCP(), DecodeUDP(), and ProcessPacket().

#define PKT_INLINE_DROP   0x20000000

Definition at line 565 of file decode.h. Referenced by BoFind(), BoGetDirection(), DropAction(), ParseXLink2State(), and XLINK2STATE_ProcessPacket().

#define PKT_LOGGED   0x80000000

Definition at line 567 of file decode.h.

#define PKT_OBFUSCATED   0x40000000

Definition at line 566 of file decode.h. Referenced by ObfuscatePacket().

#define PKT_REBUILT_FRAG   0x00000001

Definition at line 540 of file decode.h. Referenced by fpFragAlerted(), Frag2Defrag(), Frag3Defrag(), Frag3Rebuild(), ProcessPacket(), and RebuildFrag().

#define PKT_REBUILT_STREAM   0x00000002

Definition at line 541 of file decode.h. Referenced by BuildPacket(), CheckDsizeEq(), CheckDsizeGT(), CheckDsizeLT(), CheckDsizeRange(), CheckForNonReassembled(), CheckForReassembled(), CheckFromClient(), CheckTagging(), ConvertRPC(), ConvFunc(), FlowPreprocessor(), fpLogEvent(), fpSessionAlerted(), LogTcpdump(), NotForStream4(), OldUnifiedLogPacketAlert(), PortscanDetect(), PortscanPreprocFunction(), ProcessPerfMonitor(), RealUnifiedLogAlert(), and UnifiedLogPacketAlert().

#define PKT_STREAM_EST   0x00000010

Definition at line 550 of file decode.h. Referenced by BuildPacket(), fpEvalOTN(), ps_filter_ignore(), ps_tracker_update_tcp(), ReassembleStream4(), ResetFlowbits(), and TcpAction().

#define PKT_STREAM_INSERT   0x00000400

Definition at line 559 of file decode.h. Referenced by fpEvalHeaderSW(), SnortXLINK2STATE(), and StoreStreamPkt().

#define PKT_STREAM_TWH   0x00001000

Definition at line 563 of file decode.h. Referenced by ps_filter_ignore(), ps_tracker_update_tcp(), TcpAction(), and TcpActionAsync().

#define PKT_STREAM_UNEST_BI   0x00000008

Definition at line 546 of file decode.h. Referenced by ReassembleStream4().

#define PKT_STREAM_UNEST_UNI   0x00000004

Definition at line 542 of file decode.h. Referenced by fpLogEvent(), NotForStream4(), and ReassembleStream4().

#define PPP_HDRLEN   sizeof(struct ppp_header)

Definition at line 165 of file decode.h. Referenced by DecodePppSerialPkt().

#define PPP_IP   0x0021

Definition at line 168 of file decode.h. Referenced by DecodePppPktEncapsulated().

#define PPP_IPX   0x002b

Definition at line 171 of file decode.h. Referenced by DecodePppPktEncapsulated().

#define PPP_MTU   1500

Definition at line 175 of file decode.h.

#define PPP_VJ_COMP   0x002d

Definition at line 169 of file decode.h. Referenced by DecodePppPktEncapsulated().

#define PPP_VJ_UCOMP   0x002f

Definition at line 170 of file decode.h. Referenced by DecodePppPktEncapsulated().

#define PPPoE_CODE_PADI   0x09

Definition at line 378 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_CODE_PADO   0x07

Definition at line 379 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_CODE_PADR   0x19

Definition at line 380 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_CODE_PADS   0x65

Definition at line 381 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_CODE_PADT   0xa7

Definition at line 382 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_CODE_SESS   0x00

Definition at line 377 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPOE_HEADER_LEN   20

Definition at line 75 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_AC_COOKIE   0x0104

Definition at line 389 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_AC_NAME   0x0102

Definition at line 387 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_AC_SYSTEM_ERROR   0x0202

Definition at line 393 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_END_OF_LIST   0x0000

Definition at line 385 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_GENERIC_ERROR   0x0203

Definition at line 394 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_HOST_UNIQ   0x0103

Definition at line 388 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_RELAY_SESSION_ID   0x0110

Definition at line 391 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_SERVICE_NAME   0x0101

Definition at line 386 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_SERVICE_NAME_ERROR   0x0201

Definition at line 392 of file decode.h. Referenced by DecodePPPoEPkt().

#define PPPoE_TAG_VENDOR_SPECIFIC   0x0105

Definition at line 390 of file decode.h. Referenced by DecodePPPoEPkt().

#define PROMISC   1

Definition at line 332 of file decode.h. Referenced by OpenPcap().

#define READ_TIMEOUT   500

Definition at line 333 of file decode.h. Referenced by OpenPcap().

#define s_icmp_data   icmp_dun.data

Definition at line 984 of file decode.h.

#define s_icmp_gwaddr   icmp_hun.gwaddr

Definition at line 940 of file decode.h.

#define s_icmp_id   icmp_hun.idseq.id

Definition at line 941 of file decode.h.

#define s_icmp_ip   icmp_dun.ih_ip

Definition at line 981 of file decode.h.

#define s_icmp_lifetime   icmp_hun.rtradv.lifetime

Definition at line 948 of file decode.h.

#define s_icmp_mask   icmp_dun.mask

Definition at line 983 of file decode.h.

#define s_icmp_nextmtu   icmp_hun.pmtu.nextmtu

Definition at line 945 of file decode.h.

#define s_icmp_num_addrs   icmp_hun.rtradv.num_addrs

Definition at line 946 of file decode.h.

#define s_icmp_otime   icmp_dun.ts.otime

Definition at line 978 of file decode.h.

#define s_icmp_pmvoid   icmp_hun.pmtu.ipm_void

Definition at line 944 of file decode.h.

#define s_icmp_pptr   icmp_hun.pptr

Definition at line 939 of file decode.h.

#define s_icmp_radv   icmp_dun.radv

Definition at line 982 of file decode.h.

#define s_icmp_rtime   icmp_dun.ts.rtime

Definition at line 979 of file decode.h.

#define s_icmp_seq   icmp_hun.idseq.seq

Definition at line 942 of file decode.h.

#define s_icmp_ttime   icmp_dun.ts.ttime

Definition at line 980 of file decode.h.

#define s_icmp_void   icmp_hun.sih_void

Definition at line 943 of file decode.h.

#define s_icmp_wpa   icmp_hun.rtradv.wpa

Definition at line 947 of file decode.h.

#define SET_IP_HLEN (  iph, value   )     ((iph)->ip_verhl = (((iph)->ip_verhl & 0xf0) | (value & 0x0f)))

Definition at line 836 of file decode.h. Referenced by flowps_init_pkt(), Frag3Rebuild(), InitFakePkt(), and InitStream4Pkt().

#define SET_IP_VER (  iph, value   )     ((iph)->ip_verhl = (((iph)->ip_verhl & 0x0f) | (value << 4)))

Definition at line 835 of file decode.h. Referenced by flowps_init_pkt(), InitFakePkt(), and InitStream4Pkt().

#define SET_TCP_OFFSET (  tcph, value   )     ((tcph)->th_offx2 = (((tcph)->th_offx2 & 0x0f) | (value << 4)))

Definition at line 872 of file decode.h. Referenced by InitFakePkt(), and InitStream4Pkt().

#define SET_TCP_X2 (  tcph, value   )     ((tcph)->th_offx2 = (((tcph)->th_offx2 & 0xf0) | (value & 0x0f)))

Definition at line 873 of file decode.h.

#define SLIP_HEADER_LEN   16

Definition at line 81 of file decode.h. Referenced by DecodeSlipPkt().

#define SLL_ADDRLEN   8

Definition at line 693 of file decode.h.

#define SLL_HDR_LEN   16

Definition at line 692 of file decode.h.

#define SNAPLEN   1514

Definition at line 326 of file decode.h. Referenced by AlertUnixSock(), OpenPcap(), and ShowUsage().

#define SOL_TCP   6

Definition at line 316 of file decode.h.

#define TCP_HEADER_LEN   20

Definition at line 191 of file decode.h. Referenced by BuildPacket(), InitFakePkt(), and InitStream4Pkt().

#define TCP_MAX_WINSHIFT   14

Definition at line 302 of file decode.h.

#define TCP_MAXSEG   0x02

Definition at line 313 of file decode.h.

#define TCP_MAXWIN   65535

Definition at line 298 of file decode.h.

#define TCP_MSS   512

Definition at line 294 of file decode.h.

#define TCP_NODELAY   0x01

Definition at line 309 of file decode.h.

#define TCP_OFFSET (  tcph   )     (((tcph)->th_offx2 & 0xf0) >> 4)

Definition at line 868 of file decode.h. Referenced by Database(), DecodeTCP(), PrintEmbeddedTCPHeader(), PrintTCPHeader(), and RealAlertCSV().

#define TCP_OPT_BADLEN   -2

Definition at line 279 of file decode.h. Referenced by DecodeIPOptions(), DecodeTCPOptions(), and OptLenValidate().

#define TCP_OPT_TRUNC   -1

Definition at line 278 of file decode.h. Referenced by DecodeIPOptions(), DecodeTCPOptions(), and OptLenValidate().

#define TCP_OPTLENMAX   40

Definition at line 196 of file decode.h. Referenced by DecodeTCPOptions().

#define TCP_X2 (  tcph   )     ((tcph)->th_offx2 & 0x0f)

Definition at line 869 of file decode.h. Referenced by Database().

#define TCPOLEN_CC   6

Definition at line 253 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOLEN_CC_ECHO   6

Definition at line 255 of file decode.h.

#define TCPOLEN_CC_NEW   6

Definition at line 254 of file decode.h.

#define TCPOLEN_ECHO   6

Definition at line 235 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOLEN_ECHOREPLY   6

Definition at line 238 of file decode.h.

#define TCPOLEN_EOL   1

Definition at line 218 of file decode.h.

#define TCPOLEN_MAXSEG   4

Definition at line 224 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOLEN_MD5SIG   18

Definition at line 265 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOLEN_NOP   1

Definition at line 221 of file decode.h.

#define TCPOLEN_PARTIAL_PERM   2

Definition at line 244 of file decode.h.

#define TCPOLEN_PARTIAL_SVC   3

Definition at line 247 of file decode.h.

#define TCPOLEN_SACKOK   2

Definition at line 230 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOLEN_TIMESTAMP   10

Definition at line 241 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOLEN_TRAILER_CSUM   3

Definition at line 262 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOLEN_TSTAMP_APPA   (TCPOLEN_TIMESTAMP+2)

Definition at line 282 of file decode.h.

#define TCPOLEN_WSCALE   3

Definition at line 227 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_ALTCSUM   15

Definition at line 257 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_BUBBA   17

Definition at line 259 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_CC   11

Definition at line 250 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_CC_ECHO   13

Definition at line 252 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_CC_NEW   12

Definition at line 251 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_CCECHO   13

Definition at line 520 of file decode.h. Referenced by PrintTcpOptions().

#define TCPOPT_CCNEW   12

Definition at line 517 of file decode.h. Referenced by PrintTcpOptions().

#define TCPOPT_COMPRESSION   26

Definition at line 275 of file decode.h.

#define TCPOPT_CORRUPTION   23

Definition at line 271 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_ECHO   6

Definition at line 234 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_ECHOREPLY   7

Definition at line 237 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_EOL   0

Definition at line 217 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_MAXSEG   2

Definition at line 223 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_MD5SIG   19

Definition at line 264 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_NOP   1

Definition at line 220 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_PARTIAL_PERM   9

Definition at line 243 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_PARTIAL_SVC   10

Definition at line 246 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_RECORDBOUND   22

Definition at line 270 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_SACK   5

Definition at line 232 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_SACKOK   4

Definition at line 229 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TCPOPT_SCPS   20

Definition at line 268 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_SELNEGACK   21

Definition at line 269 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_SKEETER   16

Definition at line 258 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_SNAP   24

Definition at line 273 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_TIMESTAMP   8

Definition at line 240 of file decode.h. Referenced by DecodeTCPOptions(), GetTcpTimestamp(), and PrintTcpOptions().

#define TCPOPT_TRAILER_CSUM   18

Definition at line 261 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_TSTAMP_HDR   (TCPOPT_NOP<<24|TCPOPT_NOP<<16|TCPOPT_TIMESTAMP<<8|TCPOLEN_TIMESTAMP)

Definition at line 283 of file decode.h.

#define TCPOPT_UNASSIGNED   25

Definition at line 274 of file decode.h. Referenced by DecodeTCPOptions().

#define TCPOPT_WSCALE   3

Definition at line 226 of file decode.h. Referenced by DecodeTCPOptions(), and PrintTcpOptions().

#define TH_ACK   0x10

Definition at line 206 of file decode.h.

#define TH_FIN   0x01

Definition at line 202 of file decode.h.

#define TH_NORESERVED   (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG)

Definition at line 210 of file decode.h. Referenced by GetDirection(), ReassembleStream4(), and UpdateStateAsync().

#define TH_PUSH   0x08

Definition at line 205 of file decode.h.

#define TH_RES1   0x80

Definition at line 209 of file decode.h. Referenced by CreateNewSession(), CreateTCPFlagString(), and flowps_tcp_penalty().

#define TH_RES2   0x40

Definition at line 208 of file decode.h. Referenced by CreateNewSession(), CreateTCPFlagString(), flowps_tcp_penalty(), and UpdateState2().

#define TH_RST   0x04

Definition at line 204 of file decode.h.

#define TH_SYN   0x02

Definition at line 203 of file decode.h.

#define TH_URG   0x20

Definition at line 207 of file decode.h.

#define TOKENRING_LLC_LEN   8

Definition at line 80 of file decode.h.

#define TOPT_EOL   0x00

Definition at line 490 of file decode.h.

#define TOPT_MSS   0x02

Definition at line 492 of file decode.h.

#define TOPT_NOP   0x01

Definition at line 491 of file decode.h.

#define TOPT_TS   0x08

Definition at line 494 of file decode.h.

#define TOPT_WS   0x03

Definition at line 493 of file decode.h.

#define TR_ALEN   6

Definition at line 336 of file decode.h.

#define TR_HLEN   MINIMAL_TOKENRING_HEADER_LEN

Definition at line 79 of file decode.h. Referenced by DecodeTRPkt().

#define TR_RCF_BROADCAST   0x8000

Definition at line 346 of file decode.h.

#define TR_RCF_BROADCAST_MASK   0xC000

Definition at line 349 of file decode.h.

#define TR_RCF_DIR_BIT   0x80

Definition at line 344 of file decode.h.

#define TR_RCF_FRAME2K   0x20

Definition at line 348 of file decode.h.

#define TR_RCF_LEN_MASK   0x1f00

Definition at line 345 of file decode.h.

#define TR_RCF_LIMITED_BROADCAST   0xC000

Definition at line 347 of file decode.h.

#define TR_RII   0x80

Definition at line 343 of file decode.h.

#define TRH_MR_BCAST (  trhmr   )     ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0xe000) >> 13)

Definition at line 614 of file decode.h. Referenced by PrintTrHeader().

#define TRH_MR_DIR (  trhmr   )     ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0080) >> 8)

Definition at line 616 of file decode.h. Referenced by PrintTrHeader().

#define TRH_MR_LEN (  trhmr   )     ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x1F00) >> 8)

Definition at line 615 of file decode.h. Referenced by DecodeTRPkt(), and PrintTrHeader().

#define TRH_MR_LF (  trhmr   )     ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x0070) >> 7)

Definition at line 617 of file decode.h. Referenced by PrintTrHeader().

#define TRH_MR_RES (  trhmr   )     ((ntohs((trhmr)->bcast_len_dir_lf_res) & 0x000F))

Definition at line 618 of file decode.h. Referenced by PrintTrHeader().

#define TRMTU   2000

Definition at line 342 of file decode.h.

#define UDP_HEADER_LEN   8

Definition at line 192 of file decode.h. Referenced by DecodeUDP(), and PrintUDPHeader().

#define URI_COUNT   5

Definition at line 1063 of file decode.h. Referenced by fpEvalHeaderSW(), SnortHttpInspect(), and SnortPcre().

#define VTH_CFI (  vh   )     ((ntohs((vh)->vth_pri_cfi_vlan) & 0x0100) >> 12)

Definition at line 765 of file decode.h. Referenced by DecodeVlan().

#define VTH_PRIORITY (  vh   )     ((ntohs((vh)->vth_pri_cfi_vlan) & 0xe000) >> 13)

Definition at line 764 of file decode.h. Referenced by DecodeVlan().

#define VTH_VLAN (  vh   )     ((ntohs((vh)->vth_pri_cfi_vlan) & 0x0FFF))

Definition at line 766 of file decode.h. Referenced by DecodeVlan().

#define WLAN_FLAG_FRAG   0x0400

Definition at line 117 of file decode.h. Referenced by PrintWifiHeader().

#define WLAN_FLAG_FROMDS   0x0200

Definition at line 116 of file decode.h. Referenced by PrintArpHeader(), and PrintWifiHeader().

#define WLAN_FLAG_MOREDAT   0x2000

Definition at line 120 of file decode.h. Referenced by PrintWifiHeader().

#define WLAN_FLAG_ORDER   0x8000

Definition at line 122 of file decode.h. Referenced by PrintWifiHeader().

#define WLAN_FLAG_PWRMGMT   0x1000

Definition at line 119 of file decode.h. Referenced by PrintWifiHeader().

#define WLAN_FLAG_RETRY   0x0800

Definition at line 118 of file decode.h. Referenced by PrintWifiHeader().

#define WLAN_FLAG_TODS   0x0100

Definition at line 115 of file decode.h. Referenced by PrintArpHeader(), and PrintWifiHeader().

#define WLAN_FLAG_WEP   0x4000

Definition at line 121 of file decode.h. Referenced by PrintWifiHeader().

#define WLAN_TYPE_CONT_ACK   0xd4

Definition at line 100 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_CONT_CFACK   0xf4

Definition at line 102 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_CONT_CFE   0xe4

Definition at line 101 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_CONT_CTS   0xc4

Definition at line 99 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_CONT_PS   0xa4

Definition at line 97 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_CONT_RTS   0xb4

Definition at line 98 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_DATA_ACKPL   0x78

Definition at line 111 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_DATA_CFACK   0x58

Definition at line 109 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_DATA_CFPL   0x68

Definition at line 110 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_DATA_DATA   0x08

Definition at line 104 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_DATA_DTACKPL   0x38

Definition at line 107 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_DATA_DTCFACK   0x18

Definition at line 105 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_DATA_DTCFPL   0x28

Definition at line 106 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_DATA_NULL   0x48

Definition at line 108 of file decode.h. Referenced by DecodeIEEE80211Pkt().

#define WLAN_TYPE_MGMT_ASREQ   0x0

Definition at line 85 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_ASRES   0x10

Definition at line 86 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_ATIM   0x90

Definition at line 92 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_AUTH   0xb0

Definition at line 94 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_BEACON   0x80

Definition at line 91 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_DEAUTH   0xc0

Definition at line 95 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_DIS   0xa0

Definition at line 93 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_PRREQ   0x40

Definition at line 89 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_PRRES   0x50

Definition at line 90 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_REREQ   0x20

Definition at line 87 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

#define WLAN_TYPE_MGMT_RERES   0x30

Definition at line 88 of file decode.h. Referenced by DecodeIEEE80211Pkt(), and PrintWifiHeader().

---

Typedef Documentation

typedef struct _ARPHdr ARPHdr

typedef struct _DecoderFlags DecoderFlags

typedef struct _EAPHdr EAPHdr

typedef struct _EapolKey EapolKey

typedef struct _EtherARP EtherARP

typedef struct _EtherEapol EtherEapol

typedef struct _EtherHdr EtherHdr

typedef struct _EthLlc EthLlc

typedef struct _EthLlcOther EthLlcOther

typedef struct _Fddi_hdr Fddi_hdr

typedef struct _Fddi_llc_iparp Fddi_llc_iparp

typedef struct _Fddi_llc_other Fddi_llc_other

typedef struct _Fddi_llc_saps Fddi_llc_saps

typedef struct _Fddi_llc_sna Fddi_llc_sna

typedef struct _HttpUri HttpUri

typedef struct _ICMPHdr ICMPHdr

typedef struct _IPHdr IPHdr

typedef struct _OldPflog_hdr OldPflogHdr

typedef struct _Options Options

typedef struct _Packet Packet

typedef struct _Pflog_hdr PflogHdr

typedef struct _PortList PortList

typedef struct _PPPoE_Tag PPPoE_Tag

typedef struct _PPPoEHdr PPPoEHdr

typedef struct s_pseudoheader PSEUDO_HDR

typedef struct _SLLHdr SLLHdr

typedef struct _TCPHdr TCPHdr

typedef struct _Trh_hdr Trh_hdr

typedef struct _Trh_llc Trh_llc

typedef struct _Trh_mr Trh_mr

typedef struct _UDPHdr UDPHdr

typedef struct _VlanTagHdr VlanTagHdr

typedef struct _WifiHdr WifiHdr

---

Function Documentation

void DecodeARP (  u_int8_t *  , u_int32_t  , Packet *  )

Definition at line 3051 of file decode.c. References _Packet::ah, _PacketCount::arp, DEBUG_DECODE, DEBUG_WRAP, _DecoderFlags::decode_alerts, DECODE_ARP_TRUNCATED, DECODE_ARP_TRUNCATED_STR, DECODE_CLASS, _progvars::decoder_flags, _PacketCount::discards, _DecoderFlags::drop_alerts, ErrorMessage(), GENERATOR_SNORT_DECODE, InlineDrop(), InlineMode(), MODE_IDS, pc, pv, runMode, SnortEventqAdd(), and _progvars::verbose_flag. Referenced by DecodeEthPkt(), DecodeIEEE80211Pkt(), and DecodeVlan().

void DecodeChdlcPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1872 of file decode.c. References bzero, CHDLC_ADDR_MULTICAST, CHDLC_ADDR_UNICAST, CHDLC_HEADER_LEN, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), ErrorMessage(), ETHERNET_TYPE_IP, _PacketCount::other, pc, pv, and _progvars::verbose_flag. Referenced by DecodePppSerialPkt(), and SetPktProcessor().

void DecodeEAP (  u_int8_t *  , const   u_int32_t, Packet *  )

void DecodeEapol (  u_int8_t *  , u_int32_t  , Packet *  )

Definition at line 3091 of file decode.c. References DEBUG_DECODE, DEBUG_WRAP, _DecoderFlags::decode_alerts, DECODE_CLASS, DECODE_EAPOL_TRUNCATED, DECODE_EAPOL_TRUNCATED_STR, DecodeEAP(), DecodeEapolKey(), _progvars::decoder_flags, _PacketCount::discards, _DecoderFlags::drop_alerts, _PacketCount::eapol, EAPOL_TYPE_EAP, EAPOL_TYPE_KEY, _EtherEapol::eaptype, _Packet::eplh, ErrorMessage(), GENERATOR_SNORT_DECODE, InlineDrop(), InlineMode(), MODE_IDS, pc, pv, runMode, SnortEventqAdd(), and _progvars::verbose_flag. Referenced by DecodeIEEE80211Pkt().

void DecodeEapolKey (  u_int8_t *  , u_int32_t  , Packet *  )

Definition at line 3135 of file decode.c. References DEBUG_DECODE, DEBUG_WRAP, _DecoderFlags::decode_alerts, DECODE_CLASS, DECODE_EAPKEY_TRUNCATED, DECODE_EAPKEY_TRUNCATED_STR, _progvars::decoder_flags, _PacketCount::discards, _DecoderFlags::drop_alerts, _Packet::eapolk, GENERATOR_SNORT_DECODE, InlineDrop(), InlineMode(), MODE_IDS, pc, pv, runMode, SnortEventqAdd(), and _progvars::verbose_flag. Referenced by DecodeEapol().

void DecodeEncPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Referenced by SetPktProcessor().

void DecodeEthLoopback (  u_int8_t *  , u_int32_t  )

Definition at line 3232 of file decode.c. References DEBUG_DECODE, DEBUG_WRAP, _PacketCount::ethloopback, and pc. Referenced by DecodeEthPkt().

void DecodeEthPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 60 of file decode.c. References bzero, pcap_pkthdr::caplen, DEBUG_DECODE, DEBUG_WRAP, DecodeARP(), DecodeEthLoopback(), DecodeIP(), DecodeIPV6(), DecodeIPX(), DecodePPPoEPkt(), DecodeVlan(), ErrorMessage(), ETHERNET_HEADER_LEN, ETHERNET_TYPE_8021Q, ETHERNET_TYPE_ARP, ETHERNET_TYPE_IP, ETHERNET_TYPE_IPV6, ETHERNET_TYPE_IPX, ETHERNET_TYPE_LOOP, ETHERNET_TYPE_PPPoE_DISC, ETHERNET_TYPE_PPPoE_SESS, ETHERNET_TYPE_REVARP, pcap_pkthdr::len, _PacketCount::other, pc, pv, snaplen, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodeFDDIPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 836 of file decode.c. References _PacketCount::arp, bzero, pcap_pkthdr::caplen, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), DecodeVlan(), ErrorMessage(), ETHERNET_TYPE_8021Q, ETHERNET_TYPE_ARP, ETHERNET_TYPE_IP, ETHERNET_TYPE_REVARP, FDDI_DSAP_IP, FDDI_DSAP_SNA, FDDI_SSAP_IP, FDDI_SSAP_SNA, pcap_pkthdr::len, _PacketCount::other, pc, pv, snaplen, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodeI4LCiscoIPPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1837 of file decode.c. References bzero, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), _PacketCount::other, and pc. Referenced by SetPktProcessor().

void DecodeI4LRawIPPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1800 of file decode.c. References bzero, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), _PacketCount::other, and pc. Referenced by SetPktProcessor().

void DecodeICMP (  u_int8_t *  , const   u_int32_t, Packet *  )

void DecodeIEEE80211Pkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 169 of file decode.c. References bzero, pcap_pkthdr::caplen, ClearDumpBuf(), DEBUG_DECODE, DEBUG_WRAP, _DecoderFlags::decode_alerts, DECODE_BAD_80211_ETHLLC, DECODE_BAD_80211_ETHLLC_STR, DECODE_CLASS, DecodeARP(), DecodeEapol(), DecodeIP(), _progvars::decoder_flags, DecodeVlan(), _DecoderFlags::drop_alerts, ErrorMessage(), ETH_DSAP_IP, ETH_SSAP_IP, ETHERNET_TYPE_8021Q, ETHERNET_TYPE_ARP, ETHERNET_TYPE_EAPOL, ETHERNET_TYPE_IP, ETHERNET_TYPE_REVARP, GENERATOR_SNORT_DECODE, IEEE802_11_DATA_HDR_LEN, InlineDrop(), InlineMode(), pcap_pkthdr::len, MINIMAL_IEEE80211_HEADER_LEN, MODE_IDS, _PacketCount::other, pc, PrintNetData(), pv, runMode, snaplen, SnortEventqAdd(), _progvars::verbose_flag, _PacketCount::wifi_control, _PacketCount::wifi_data, _PacketCount::wifi_mgmt, WLAN_TYPE_CONT_ACK, WLAN_TYPE_CONT_CFACK, WLAN_TYPE_CONT_CFE, WLAN_TYPE_CONT_CTS, WLAN_TYPE_CONT_PS, WLAN_TYPE_CONT_RTS, WLAN_TYPE_DATA_ACKPL, WLAN_TYPE_DATA_CFACK, WLAN_TYPE_DATA_CFPL, WLAN_TYPE_DATA_DATA, WLAN_TYPE_DATA_DTACKPL, WLAN_TYPE_DATA_DTCFACK, WLAN_TYPE_DATA_DTCFPL, WLAN_TYPE_DATA_NULL, WLAN_TYPE_MGMT_ASREQ, WLAN_TYPE_MGMT_ASRES, WLAN_TYPE_MGMT_ATIM, WLAN_TYPE_MGMT_AUTH, WLAN_TYPE_MGMT_BEACON, WLAN_TYPE_MGMT_DEAUTH, WLAN_TYPE_MGMT_DIS, WLAN_TYPE_MGMT_PRREQ, WLAN_TYPE_MGMT_PRRES, WLAN_TYPE_MGMT_REREQ, and WLAN_TYPE_MGMT_RERES. Referenced by SetPktProcessor().

void DecodeIP (  u_int8_t *  , const   u_int32_t, Packet *  )

void DecodeIPOptions (  u_int8_t *  , u_int32_t  , Packet *  )

Definition at line 3606 of file decode.c. References _Options::code, _Options::data, DEBUG_DECODE, DEBUG_WRAP, DECODE_CLASS, DECODE_IPV4OPT_BADLEN, DECODE_IPV4OPT_BADLEN_STR, DECODE_IPV4OPT_TRUNCATED, DECODE_IPV4OPT_TRUNCATED_STR, _progvars::decoder_flags, _DecoderFlags::drop_ipopt_decode, GENERATOR_SNORT_DECODE, InlineDrop(), InlineMode(), _Packet::ip_option_count, _Packet::ip_options, _DecoderFlags::ipopt_decode, IPOPT_EOL, IPOPT_NOP, IPOPT_RTRALT, _Options::len, MODE_IDS, NULL, opt_count, OptLenValidate(), pv, runMode, SnortEventqAdd(), TCP_OPT_BADLEN, and TCP_OPT_TRUNC. Referenced by DecodeIP().

void DecodeIPV6 (  u_int8_t *  , u_int32_t  )

Definition at line 3214 of file decode.c. References DEBUG_DECODE, DEBUG_WRAP, _PacketCount::ipv6, and pc. Referenced by DecodeEthPkt(), DecodeOldPflog(), and DecodePflog().

void DecodeIPX (  u_int8_t *  , u_int32_t  )

Definition at line 3251 of file decode.c. References DEBUG_DECODE, DEBUG_WRAP, _PacketCount::ipx, and pc. Referenced by DecodeEthPkt(), and DecodePppPktEncapsulated().

void DecodeLinuxSLLPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Referenced by SetPktProcessor().

void DecodeNullPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 576 of file decode.c. References bzero, pcap_pkthdr::caplen, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), ErrorMessage(), pcap_pkthdr::len, NULL_HDRLEN, pv, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodeOldPflog (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1098 of file decode.c. References bzero, pcap_pkthdr::caplen, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), DecodeIPV6(), ErrorMessage(), pcap_pkthdr::len, OLDPFLOG_HDRLEN, _PacketCount::other, pc, pv, snaplen, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodePflog (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1171 of file decode.c. References bzero, pcap_pkthdr::caplen, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), DecodeIPV6(), ErrorMessage(), pcap_pkthdr::len, _PacketCount::other, pc, PFLOG_HDRLEN, pv, snaplen, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodePPPoEPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1249 of file decode.c. References pcap_pkthdr::caplen, _PPPoEHdr::code, DEBUG_DECODE, DEBUG_WRAP, _DecoderFlags::decode_alerts, DECODE_BAD_PPPOE, DECODE_BAD_PPPOE_STR, DECODE_CLASS, DecodePppPktEncapsulated(), _progvars::decoder_flags, _DecoderFlags::drop_alerts, _Packet::eh, ErrorMessage(), _EtherHdr::ether_dst, _EtherHdr::ether_src, _EtherHdr::ether_type, ETHERNET_TYPE_PPPoE_DISC, ETHERNET_TYPE_PPPoE_SESS, GENERATOR_SNORT_DECODE, InlineDrop(), InlineMode(), pcap_pkthdr::len, memcpy, MODE_IDS, _Packet::pkth, PPPoE_CODE_PADI, PPPoE_CODE_PADO, PPPoE_CODE_PADR, PPPoE_CODE_PADS, PPPoE_CODE_PADT, PPPoE_CODE_SESS, PPPOE_HEADER_LEN, PPPoE_TAG_AC_COOKIE, PPPoE_TAG_AC_NAME, PPPoE_TAG_AC_SYSTEM_ERROR, PPPoE_TAG_END_OF_LIST, PPPoE_TAG_GENERIC_ERROR, PPPoE_TAG_HOST_UNIQ, PPPoE_TAG_RELAY_SESSION_ID, PPPoE_TAG_SERVICE_NAME, PPPoE_TAG_SERVICE_NAME_ERROR, PPPoE_TAG_VENDOR_SPECIFIC, _Packet::pppoeh, pv, runMode, snaplen, SnortEventqAdd(), strlcpy, and _progvars::verbose_flag. Referenced by DecodeEthPkt().

void DecodePppPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1638 of file decode.c. References bzero, CHDLC_ADDR_BROADCAST, CHDLC_CTRL_UNNUMBERED, DEBUG_DECODE, DEBUG_WRAP, DecodePppPktEncapsulated(), ErrorMessage(), pv, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodePppPktEncapsulated (  Packet *  , const   u_int32_t, u_int8_t *  )

void DecodePppSerialPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1686 of file decode.c. References bzero, CHDLC_ADDR_BROADCAST, CHDLC_CTRL_UNNUMBERED, DEBUG_DECODE, DEBUG_WRAP, DecodeChdlcPkt(), DecodePppPktEncapsulated(), ErrorMessage(), PPP_HDRLEN, pv, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodeRawPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1770 of file decode.c. References bzero, DEBUG_DECODE, DEBUG_WRAP, and DecodeIP(). Referenced by SetPktProcessor().

void DecodeSlipPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 1728 of file decode.c. References bzero, pcap_pkthdr::caplen, DEBUG_DECODE, DEBUG_WRAP, DecodeIP(), ErrorMessage(), pcap_pkthdr::len, and SLIP_HEADER_LEN. Referenced by SetPktProcessor().

void DecodeTCP (  u_int8_t *  , const   u_int32_t, Packet *  )

void DecodeTCPOptions (  u_int8_t *  , u_int32_t  , Packet *  )

Definition at line 3385 of file decode.c. References _Options::code, _Options::data, DEBUG_DECODE, DEBUG_WRAP, DECODE_CLASS, DECODE_TCPOPT_BADLEN, DECODE_TCPOPT_BADLEN_STR, DECODE_TCPOPT_EXPERIMENT, DECODE_TCPOPT_EXPERIMENT_STR, DECODE_TCPOPT_OBSOLETE, DECODE_TCPOPT_OBSOLETE_STR, DECODE_TCPOPT_TRUNCATED, DECODE_TCPOPT_TRUNCATED_STR, DECODE_TCPOPT_TTCP, DECODE_TCPOPT_TTCP_STR, _progvars::decoder_flags, _DecoderFlags::drop_tcpopt_decode, _DecoderFlags::drop_tcpopt_experiment, _DecoderFlags::drop_tcpopt_obsolete, _DecoderFlags::drop_tcpopt_ttcp, GENERATOR_SNORT_DECODE, InlineDrop(), InlineMode(), _Options::len, MODE_IDS, NULL, opt_count, OptLenValidate(), pv, runMode, SnortEventqAdd(), TCP_OPT_BADLEN, TCP_OPT_TRUNC, _Packet::tcp_option_count, _Packet::tcp_options, TCP_OPTLENMAX, _Packet::tcph, TCPOLEN_CC, TCPOLEN_ECHO, TCPOLEN_MAXSEG, TCPOLEN_MD5SIG, TCPOLEN_SACKOK, TCPOLEN_TIMESTAMP, TCPOLEN_TRAILER_CSUM, TCPOLEN_WSCALE, TCPOPT_ALTCSUM, TCPOPT_BUBBA, TCPOPT_CC, TCPOPT_CC_ECHO, TCPOPT_CC_NEW, TCPOPT_CORRUPTION, _DecoderFlags::tcpopt_decode, TCPOPT_ECHO, TCPOPT_ECHOREPLY, TCPOPT_EOL, _DecoderFlags::tcpopt_experiment, TCPOPT_MAXSEG, TCPOPT_MD5SIG, TCPOPT_NOP, _DecoderFlags::tcpopt_obsolete, TCPOPT_PARTIAL_PERM, TCPOPT_PARTIAL_SVC, TCPOPT_RECORDBOUND, TCPOPT_SACK, TCPOPT_SACKOK, TCPOPT_SCPS, TCPOPT_SELNEGACK, TCPOPT_SKEETER, TCPOPT_SNAP, TCPOPT_TIMESTAMP, TCPOPT_TRAILER_CSUM, _DecoderFlags::tcpopt_ttcp, TCPOPT_UNASSIGNED, and TCPOPT_WSCALE. Referenced by DecodeTCP().

void DecodeTRPkt (  Packet *  , struct pcap_pkthdr *  , u_int8_t *  )

Definition at line 618 of file decode.c. References _PacketCount::arp, bzero, pcap_pkthdr::caplen, DEBUG_DECODE, DEBUG_WRAP, _DecoderFlags::decode_alerts, DECODE_BAD_TR_ETHLLC, DECODE_BAD_TR_ETHLLC_STR, DECODE_BAD_TR_MR_LEN, DECODE_BAD_TR_MR_LEN_STR, DECODE_BAD_TRH, DECODE_BAD_TRH_STR, DECODE_BAD_TRHMR, DECODE_BAD_TRHMR_STR, DECODE_CLASS, DecodeIP(), _progvars::decoder_flags, DecodeVlan(), _DecoderFlags::drop_alerts, ErrorMessage(), ETHERNET_TYPE_8021Q, ETHERNET_TYPE_ARP, ETHERNET_TYPE_IP, ETHERNET_TYPE_REVARP, GENERATOR_SNORT_DECODE, InlineDrop(), InlineMode(), IPARP_SAP, pcap_pkthdr::len, MODE_IDS, NULL, _PacketCount::other, pc, pv, runMode, snaplen, SnortEventqAdd(), TR_HLEN, TRH_MR_LEN, and _progvars::verbose_flag. Referenced by SetPktProcessor().

void DecodeUDP (  u_int8_t *  , const   u_int32_t, Packet *  )

void DecodeVlan (  u_int8_t *  , const   u_int32_t, Packet *  )

void InitDecoderFlags (  void   )

Setup all the flags for the decoder alerts Definition at line 3702 of file decode.c. References _DecoderFlags::decode_alerts, _progvars::decoder_flags, _DecoderFlags::drop_alerts, _DecoderFlags::drop_ipopt_decode, _DecoderFlags::drop_tcpopt_decode, _DecoderFlags::drop_tcpopt_experiment, _DecoderFlags::drop_tcpopt_obsolete, _DecoderFlags::drop_tcpopt_ttcp, _DecoderFlags::ipopt_decode, pv, _DecoderFlags::tcpopt_decode, _DecoderFlags::tcpopt_experiment, _DecoderFlags::tcpopt_obsolete, and _DecoderFlags::tcpopt_ttcp. Referenced by SnortMain().

---