#include <decode.h>
Data Fields | |
| yfTime_t | ptime |
| Packet timestamp. | |
| yfFlowKey_t | key |
| Flow key containing decoded IP and transport headers. | |
| size_t | allHeaderLen |
| Length of all headers, L2, L3, L4. | |
| struct pcap_pkthdr | pcap_hdr |
| pcap header | |
| pcap_t * | pcapt |
| pcap struct | |
| uint64_t | pcap_offset |
| offset into pcap | |
| uint16_t | pcap_caplist |
| caplist | |
| uint32_t | iplen |
| Packet IP length. | |
| uint16_t | ifnum |
| Interface number packet was decoded from. | |
| uint8_t | frag |
| flag for determining if the packet was fragmented 0-no, 1-yes, 2-not fully assembled | |
| yfTCPInfo_t | tcpinfo |
| TCP information structure. | |
| yfL2Info_t | l2info |
| Decoded layer 2 information. | |
| size_t | paylen |
| Length of payload available in captured payload buffer. | |
| uint8_t | payload [1] |
| Captured payload buffer. | |
Full packet information structure.
Used in the packet ring buffer.
| uint16_t yfPBuf_st::ifnum |
Interface number packet was decoded from.
Currently unused.
| uint8_t yfPBuf_st::payload[1] |
Captured payload buffer.
Note that this in a convenience field; the actual field is larger than one byte.