Packet helpers
The packet list, the frame queue, packet structures and the compressed payload store.
Generated by make docs from the source and GCC's call graph. Back to the Function explorer.
src/helpers/fpacket.c
A packet (fpacket_t): creation, payload copy, RAM footprint and freeing
fpacket_new
fpacket_t *fpacket_new(uint16_t if_id, enum PACKET_SRC ptype, char *ifname, enum LINK_TYPE link)
src/helpers/fpacket.c:15 · non-static · both builds
An empty packet: no layer decoded yet. ifname is copied (a loaded packet has no interface to borrow it from). NULL if an allocation fails.
Called by: process_packet, get_record
Calls: my_strlen, my_strcpy
Library and system calls: free, malloc
fpacket_set_payload
int fpacket_set_payload(fpacket_t *packet, const uint8_t *payload, uint16_t payload_len)
src/helpers/fpacket.c:59 · non-static · both builds
Copies the payload: the raw frame it comes from is freed once parsed. 0 on success, 1 if the allocation fails.
Called by: process_packet
Library and system calls: malloc, memcpy
alloc_cost
static uint64_t alloc_cost(uint64_t n)
src/helpers/fpacket.c:74 · static · both builds
What malloc really takes for n bytes: glibc's 16-byte chunks with an 8-byte header, 32 at least (Windows' heap is in the same range)
Called by: fpacket_footprint
fpacket_footprint
uint64_t fpacket_footprint(const fpacket_t *p)
src/helpers/fpacket.c:81 · non-static · both builds
The RAM a stored packet takes: its list node, record, headers and interface name (and its payload when there's no spool), as allocated (from
includes/packets.h)
Called by: packets_add
Calls: alloc_cost, my_strlen
fpacket_delete
void fpacket_delete(fpacket_t *packet)
src/helpers/fpacket.c:98 · non-static · both builds
Called by: process_packet, raw_to_f, load_records, get_record, packet_list_delete
Library and system calls: free
src/helpers/packet_list.c
The packet list (packet_list_t): appending with the next id, finding by id
packet_list_new
static packet_list_t *packet_list_new(fpacket_t *packet)
src/helpers/packet_list.c:13 · static · both builds
A node holding packet, NULL if the allocation fails
Called by: plist_add_packet
Library and system calls: malloc
packet_list_delete
static void packet_list_delete(packet_list_t *pkt_l)
src/helpers/packet_list.c:26 · static · both builds
Called by: plist_destroy
Calls: fpacket_delete
Library and system calls: free
plist_add_packet
int plist_add_packet(packet_list_t **head, packet_list_t **tail, fpacket_t *packet)
src/helpers/packet_list.c:35 · non-static · both builds
Appends packet after *tail with the next id (1 for the first one). 0 on success, 1 if the allocation fails (the packet isn't added). (from
includes/packets.h)
Called by: packets_add
Calls: packet_list_new
plist_find
packet_list_t *plist_find(packet_list_t *head, uint32_t list_id)
src/helpers/packet_list.c:52 · non-static · both builds
The node whose packet has this id, NULL if there is none (from
includes/packets.h)
Called by: info_command
plist_destroy
void plist_destroy(packet_list_t *head)
src/helpers/packet_list.c:60 · non-static · both builds
Called by: netotter_delete
Calls: packet_list_delete
src/helpers/packet_utils.c
Adding packets within the RAM budget, the capture-full alert, and printing the list through the filters
packets_add
int packets_add(netotter_t *netotter, fpacket_t *packet)
src/helpers/packet_utils.c:16 · non-static · both builds
Appends packet to the list unless that would pass PACKETS_RAM_MAX (capture_full is then set). 0 if it's added, 1 if it isn't (the caller frees it): full, or out of memory. (from
includes/packets.h)
Called by: raw_to_f, load_records
Calls: anomalies_packet, fpacket_footprint, plist_add_packet
limit_message
void limit_message(const char *start, const char *end, char *buf, int size)
src/helpers/packet_utils.c:35 · non-static · both builds
"<start><PACKETS_RAM_MAX in MiB> MiB<end>" into buf (size bytes): the alerts quote the real limit, whatever it was built with
Called by: handle_key, load_records, capture_full_check
Calls: my_strappend
print_alert
void print_alert(const char *text)
src/helpers/packet_utils.c:53 · non-static · both builds
A line that must not be missed: bold red on a color terminal, in capitals otherwise (from
includes/packets.h)
Called by: handle_key, load_records, capture_full_check
Calls: my_putstr, my_strlen, term_colors, term_colors
Library and system calls: free, malloc
capture_full_check
int capture_full_check(netotter_t *netotter, lib_common_t *os_lib)
src/helpers/packet_utils.c:73 · non-static · both builds
Once capture_full is set: stops every interface and says why, once. 1 if the capture is full (the CLI mode then stops). (from
includes/packets.h)
Called by: run_cli, run_interactive
Calls: limit_message, print_alert, my_putstr, disable_all, disable_all
display_packets
void display_packets(netotter_t *netotter, int output_buffer)
src/helpers/packet_utils.c:94 · non-static · both builds
Prints the packets the active filters let through (all of them without filters). With filters, ends with how many were shown.
Called by: run_cli, list_command
Calls: print_packet_line, filters_match, my_putunbr, my_putstr
src/helpers/payload_store.c
The packets' payloads, compressed (lz_compress) and kept in the spool, a temporary file, instead of RAM. Nothing is decompressed but for the 'i' details.
store_init
int store_init(payload_store_t *store)
src/helpers/payload_store.c:15 · non-static · both builds
Allocates the buffers and opens the spool, announcing where it is (it falls back to RAM when it can't). 0 on success, 1 if out of memory. (from
includes/payload_store.h)
Called by: netotter
Calls: my_putstr, spool_open, spool_open
Library and system calls: malloc
store_flush
int store_flush(payload_store_t *store)
src/helpers/payload_store.c:37 · non-static · both builds
Writes what's buffered to the spool. 0 on success, 1 on error. (from
includes/payload_store.h)
Called by: raw_to_f, load_records, spool_append
Calls: my_putstr, spool_write_at, spool_write_at
store_free
void store_free(payload_store_t *store)
src/helpers/payload_store.c:53 · non-static · both builds
Called by: netotter_delete
Calls: spool_close, spool_close
Library and system calls: free, memset
spool_append
static int spool_append(payload_store_t *store, const uint8_t *bytes, uint16_t len)
src/helpers/payload_store.c:64 · static · both builds
Appends len bytes at the spool's end (store->size), through the write buffer. 0 on success, 1 on a write error.
Called by: store_add
Calls: store_flush
Library and system calls: memcpy
store_add
int store_add(payload_store_t *store, fpacket_t *packet, const uint8_t *bytes, uint16_t len, uint8_t flags)
src/helpers/payload_store.c:77 · non-static · both builds
Stores bytes as the packet's payload as they are (a loaded save): len bytes, compressed if flags has PAYLOAD_COMPRESSED. 0 on success, 1 on error. (from
includes/payload_store.h)
Called by: get_payload, store_payload
Calls: spool_append
Library and system calls: malloc, memcpy
store_payload
int store_payload(payload_store_t *store, fpacket_t *packet)
src/helpers/payload_store.c:95 · non-static · both builds
Stores the packet's parsed payload (compressed if it gets smaller) and frees it. 0 on success, 1 on error. (from
includes/payload_store.h)
Called by: process_packet
Calls: store_add, lz_compress
Library and system calls: free
store_stored_bytes
const uint8_t *store_stored_bytes(payload_store_t *store, fpacket_t *packet)
src/helpers/payload_store.c:113 · non-static · both builds
The packet's stored bytes, untouched (stored_len of them): what the saves copy. NULL if they can't be read back. (from
includes/payload_store.h)
Called by: put_record, store_read_payload
Calls: spool_read_at, spool_read_at
store_read_payload
const uint8_t *store_read_payload(payload_store_t *store, fpacket_t *packet)
src/helpers/payload_store.c:129 · non-static · both builds
The packet's payload, decompressed (payload_len bytes): only for the 'i' details. NULL if it can't be read back or is corrupted. (from
includes/payload_store.h)
Called by: info_command
Calls: store_stored_bytes, lz_decompress
src/helpers/queue.c
The queue of raw frames (queue_t) a tick fills
queue_purge
void queue_purge(queue_t *q)
src/helpers/queue.c:11 · non-static · both builds
Called by: netotter_delete, raw_to_f
Library and system calls: free
User guide
- Overview
- Installation
- Getting started
- Command-line options
- Interactive commands
- Display filters
- Analysis view
- Reverse DNS and privacy
- Anomaly detection
- Save files
- Memory and limits
- Troubleshooting
Developer documentation
- Overview
- Building
- Architecture
- OS backends
- Packet parsing
- Packet storage
- Save format
- Hostname learning
- Reverse DNS internals
- Filters and analysis internals
- Anomaly lab
- Coding conventions
- Function explorer
Learning