snort_packet

struct _SFsnortpkt

1. SFDAQ_pktheader_t *pkt_header // DAQ:Data Acquisition

	typedef DAQ_PktHdr_t SFDAQ_PktHdr_t;
			typedef struct _daq_pkthdr
			{
			 struct timeval ts;      /* Timestamp */
			 uint32_t caplen;        /* Length of the portion present */
			 uint32_t pktlen;        /* Length of this packet (off wire) */
			 int32_t ingress_index;  /* Index of the inbound interface. */
			 int32_t egress_index;   /* Index of the outbound interface. */
			 int32_t ingress_group;  /* Index of the inbound group. */
			 int32_t egress_group;   /* Index of the outbound group. */
			 uint32_t flags;         /* Flags for the packet (DAQ_PKT_FLAG_*) */
			 uint32_t opaque;        /* Opaque context value from the DAQ module
										or underlying hardware.
										Directly related to the opaque value in
										FlowStats. */
			 void *priv_ptr;         /* Private data pointer */
			} DAQ_PktHdr_t;

2. int pkt_data : length of packet etc

3. eth_arp_header : Ethernet ARP Header. ARP: Address Resolution Protocol used by IP.

4.     const EtherHeader *ether_header;


	typedef struct _EtherHeader
	{
		uint8_t ether_destination[6];
		uint8_t ether_source[6];
		uint16_t ethernet_type;

	} EtherHeader;

5.     const VlanHeader *vlan_tag_header;

typedef struct _VlanHeader
{
    uint16_t vth_pri_cfi_vlan;
    uint16_t vth_proto;  /* protocol field... */

} VlanHeader;

6.     void *ether_header_llc;

llc :  logical link control (LLC) data communication protocol layer is the upper sublayer of the data link layer (layer 2) of the seven-layer OSI model. The LLC sublayer provides multiplexing mechanisms that make it possible for several network protocols

7.    void *ether_header_other;

8.     const void *ppp_over_ether_header;

PPP: Point to point protocol: direct connection between two nodes

9.     const void *gre_header;
	Generic Routing Encapsulation (GRE) is a tunneling protocol developed by Cisco Systems that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network.

10.     uint32_t *mpls;

Multiprotocol Label Switching (MPLS) is a mechanism in high-performance telecommunications networks that directs data from one network node to the next based on short path labels rather than long network addresses, avoiding complex lookups in a routing table.

11.     const CiscoMetaHdr *cmdh;                /* Cisco Metadata Header */

typedef struct _CiscoMetaHdr
{
    uint8_t version; // This must be 1
    uint8_t length; //This is the header size in bytes / 8
} CiscoMetaHdr;

12.13.14.
const IPV4Header *ip4_header, *orig_ip4_header;
const IPV4Header *inner_ip4_header; //for IP in IP (ip tunneling protocol)
const IPV4Header *outer_ip4_header;


typedef struct _IPV4Header
{
    uint8_t version_headerlength;
    uint8_t type_service;
    uint16_t data_length;
    uint16_t identifier;
    uint16_t offset;
    uint8_t time_to_live;
    uint8_t proto;
    uint16_t checksum;
    struct in_addr source;
    struct in_addr destination;
} IPV4Header;

15.    const TCPHeader *tcp_header, *orig_tcp_header;

Transmission Control Protocol
typedef struct _TCPHeader
{
    uint16_t source_port;
    uint16_t destination_port;
    uint32_t sequence;
    uint32_t acknowledgement;
    uint8_t offset_reserved;
    uint8_t flags;
    uint16_t window;
    uint16_t checksum;
    uint16_t urgent_pointer;
} TCPHeader;

16.17.18.
 User Datagram Protocol
const UDPHeader *udp_header, *orig_udp_header;
const UDPHeader *inner_udph;   /* if Teredo + UDP, this will be the inner UDP header */
const UDPHeader *outer_udph;   /* if Teredo + UDP, this will be the outer UDP header */

typedef struct _UDPHeader
{
    uint16_t source_port;
    uint16_t destination_port;
    uint16_t data_length;
    uint16_t checksum;
} UDPHeader;

??19.     const ICMPHeader *icmp_header, *orig_icmp_header;

 Internet Control Message Protocol

 typedef struct _ICMPHeader
{
    uint8_t type;
    uint8_t code;
    uint16_t checksum;

    union
    {
        /* type 12 */
        uint8_t parameter_problem_ptr;

        /* type 5 */
        struct in_addr gateway_addr;

        /* type 8, 0 */
        ICMPSequenceID echo;

        /* type 13, 14 */
        ICMPSequenceID timestamp;

        /* type 15, 16 */
        ICMPSequenceID info;

        int voidInfo;

        /* type 3/code=4 (Path MTU, RFC 1191) */
        struct path_mtu
        {
            uint16_t voidInfo;
            uint16_t next_mtu;
        } path_mtu;

        /* type 9 */
        struct router_advertisement
        {
            uint8_t number_addrs;
            uint8_t entry_size;
            uint16_t lifetime;
        } router_advertisement;
    } icmp_header_union;


20.21.22
const uint8_t *payload;
const uint8_t *ip_payload;
const uint8_t *outer_ip_payload;

23.24
?????
void *stream_session; //streaming layer??
void *fragmentation_tracking_ptr;

25.IP4Hdr *ip4h, *orig_ip4h;

typedef struct _IPv4Hdr
{
    uint8_t ip_verhl;      /* version & header length */
    uint8_t ip_tos;        /* type of service */
    uint16_t ip_len;       /* datagram length */
    uint16_t ip_id;        /* identification  */
    uint16_t ip_off;       /* fragment offset */
    uint8_t ip_ttl;        /* time to live field */
    uint8_t ip_proto;      /* datagram protocol */
    uint16_t ip_csum;      /* checksum */
    IPAddresses* ip_addrs; /* IP addresses*/
} IP4Hdr;

26.     IP6Hdr *ip6h, *orig_ip6h;
typedef struct _IPv6Hdr
{
    uint32_t vcl;      /* version, class, and label */
    uint16_t len;      /* length of the payload */
    uint8_t  next;     /* next header
                         * Uses the same flags as
                         * the IPv4 protocol field */
    uint8_t  hop_lmt;  /* hop limit */
    IPAddresses* ip_addrs; /* IP addresses*/
} IP6Hdr;

27.     ICMP6Hdr *icmp6h, *orig_icmp6h;

typedef struct _ICMP6
{
    uint8_t type;
    uint8_t code;
    uint16_t csum;

} ICMP6Hdr;

28.29.30.31
??????????????????
    IPH_API* iph_api;
    IPH_API* orig_iph_api;
    IPH_API* outer_iph_api;
	    IPH_API* outer_orig_iph_api;

32.33.34.
???
 int family;
    int orig_family;
    int outer_family;

35. PreprocEnableMask  preprocessor_bit_mask;

36.     uint32_t flags;
uint32_t xtradata_mask;

    uint16_t proto_bits;

39.  uint16_t payload_size;
    uint16_t ip_payload_size;
    uint16_t normalized_payload_size;
    uint16_t actual_ip_length;
    uint16_t outer_ip_payload_size;

    uint16_t ip_fragment_offset;
    uint16_t ip_frag_length;
    uint16_t ip4_options_length;
    uint16_t tcp_options_length;

    uint16_t src_port;
    uint16_t dst_port;
    uint16_t orig_src_port;
    uint16_t orig_dst_port;

??52. int16_t application_protocol_ordinal;

53. :/
 uint8_t ip_fragmented;
    uint8_t ip_more_fragments;
    uint8_t ip_dont_fragment;
    uint8_t ip_reserved;
    uint8_t num_ip_options;
    uint8_t num_tcp_options;
    uint8_t num_ip6_extensions;
    uint8_t ip6_frag_extension;

    uint8_t invalid_flags;
    uint8_t encapsulated;
    uint8_t GTPencapsulated;
    uint8_t next_layer_index;

66.
#ifndef NO_NON_ETHER_DECODER
    const void *fddi_header;
    void *fddi_saps;
    void *fddi_sna;
    void *fddi_iparp;
    void *fddi_other;

    const void *tokenring_header;
    void *tokenring_header_llc;
    void *tokenring_header_mr;

    void *pflog1_header;
    void *pflog2_header;
    void *pflog3_header;
    void *pflog4_header;

#ifdef DLT_LINUX_SLL
    const void *sll_header;
#endif
#ifdef DLT_IEEE802_11
    const void *wifi_header;
#endif
    const void *ether_eapol_header;
    const void *eapol_headear;
    const uint8_t *eapol_type;
    void *eapol_key;
#endif

101. IPOptions ip_options[MAX_IP_OPTIONS];
    TCPOptions tcp_options[MAX_TCP_OPTIONS];

typedef struct _IPOptions
{
    uint8_t option_code;
    uint8_t length;
    uint8_t *option_data;
} IPOptions;

103.     IP6Extension *ip6_extensions;

typedef struct _IPv6Extension
{
    uint8_t option_type;
    const uint8_t *option_data;
} IP6Extension;

104.    CiscoMetaOpt *cmd_options;    /* Cisco Metadata header options */

typedef struct _CiscoMetaOpt
{
    uint16_t opt_len_type;  /* 3-bit length + 13-bit type. Length of 0 = 4. Type must be 1. */
    uint16_t sgt;           /* Can be any value except 0xFFFF */
} CiscoMetaOpt;

105.
?????
  const uint8_t *ip_frag_start;
    const uint8_t *ip4_options_data;
    const uint8_t *tcp_options_data;

108.     const IP6RawHdr* raw_ip6_header;

typedef struct _IP6RawHdr
{
    uint32_t vcl;          /* version, class, and label */
    uint16_t payload_len;  /* length of the payload */
    uint8_t  next_header;  /* same values as ip4 protocol field + new ip6 values */
    uint8_t  hop_limit;    /* same usage as ip4 ttl */

    struct in6_addr src_addr;
    struct in6_addr dst_addr;
} IP6RawHdr;

109.     ProtoLayer proto_layers[MAX_PROTO_LAYERS];

typedef struct {
    PROTO_ID proto_id;
    uint16_t proto_length;
    uint8_t* proto_start;
} ProtoLayer;