Comments (5)
Ah yes, you are right, this seems like a duplicate of #657. Apologies for not noticing that.
My 2 cents: I think the correct behavior is what suggested by @weyrick in #657. For VLAN layers and similar cases at the link layer, can't you look at the header's EtherType field (or other header fields for link layers other than Ethernet) to determine the type of the next layer and decide if you do need to parse it or not, depending on the value of parseUntilLayer
?
https://en.wikipedia.org/wiki/IEEE_802.1Q
Also, the transport layer is well defined. If one asks to stop parsing there (and not parse the application layer payload), I think it should be feasible to honor that request. But I don't know the pcpp code base well enough to make more detailed suggestions.
For my use case (do not parse application layer) using < parseUntilLayer
instead of <=
is sufficient, so I fixed it in my local fork, but as you mentioned this may not generalize to all cases/layers without further changes.
Thanks for looking into this.
from pcapplusplus.
could you provide more detail? such as the pcap file of the packet that you tried to parse.
from pcapplusplus.
I found this bug when trying to parse packets containing malformed DNS messages:
20180203-dns.zip
pcpp::Packet packet(&rawPacket, pcpp::OsiModelTransportLayer);
still causes a DNS parsing error message, indicating that parsing goes beyond the transport layer (UDP, in this case) and continues to the next layer.
The DNS parsing error is DNS layer contains more than 300 resources, probably a bad packet. Skipping parsing DNS resources
, which is caused because DnsLayer::parseResources()
is called, although it should not be, if parsing actually stopped at the UDP layer.
from pcapplusplus.
@perdisci I think it's a duplicate of #657, am I missing something?
Please see my response here on why an "extra layer" is being parsed: #657 (comment)
The issue is that there might be several layers of the same OSI layer. The most trivial example I can think of is multiple VLAN layers. If we change <= to < only the first VLAN layer will be parsed.
The only way to know what the next layer would be is to parse it. Maybe we can introduce "partial parsing" or "detect layer" functionality that does the minimum work needed to detect what is the next layer 🤔
from pcapplusplus.
Thanks @perdisci ! yes, I think @weyrick 's idea is a nice way to fix it with minimum API changes. #657 is still open so anyone interested can make these changes.
If that's ok with you, I think we can close this issue to avoid duplicates
from pcapplusplus.
Related Issues (20)
- Pcapng Parsing failure/confusion if unknown interface ID HOT 12
- Error when reading a packet HOT 1
- Why is std::byte not used? HOT 2
- Jumbo Frames in DPDK devices HOT 7
- Power of 2 restriction for number of queues in DpdkDevice HOT 3
- Fix building warning due to LightPcapNg HOT 10
- Migrate LightPcapNg to the forked repo HOT 9
- Error linking pcapplusplus using vcpkg and CMake. HOT 2
- improve macOS get default gateway IP HOT 13
- PcapPlusPlus Configuration Error in CMake with vcpkg HOT 8
- PcapLiveDevice socket is not close HOT 2
- Problem with TcpReassembly and chunked transfer encoding HOT 6
- SNI Extension with zero length HOT 2
- Find alternative package for netifaces HOT 1
- Transfer this repository into PcapPlusPlus GitHub organization HOT 12
- warning C4193 HOT 4
- warning C4133 HOT 1
- warning C4129 HOT 1
- -DBUILD_SHARED_LIBS=ON cannot work in Windows HOT 12
- Address all MSVC compilation warnings
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pcapplusplus.