Function pfwl_dissect_from_L2

• Defined in File peafowl.h

Function Documentation

pfwl_status_t pfwl_dissect_from_L2(pfwl_state_t *state, const unsigned char *pkt, size_t length, double timestamp, pfwl_protocol_l2_t datalink_type, pfwl_dissection_info_t *dissection_info)

Dissects the packet starting from the beginning of the L2 (datalink) header.

Return

The status of the identification process.

Parameters

• state: The state of the library.

• pkt: The pointer to the beginning of datalink header.

• length: Length of the packet.

• timestamp: The current time. The time unit depends on the timers used by the caller and can be set through the pfwl_set_timestamp_unit call. By default it is assumed that the timestamps unit is ‘seconds’.

• datalink_type: The datalink type. They match 1:1 the pcap datalink types. You can convert a PCAP datalink type to a Peafowl datalink type by calling the function ‘pfwl_convert_pcap_dlt’.

• dissection_info: The result of the dissection. All its bytes must be set to 0 before calling this call. Dissection information from L2 to L7 will be filled in by this call.