最新zeek学习（三）——包获取_zeek pktdumper(1)，2024年最新腾讯竟然又偷偷开源了一套Golang原生UI框架

既有适合小白学习的零基础资料，也有适合3年以上经验的小伙伴深入学习提升的进阶课程，涵盖了95%以上Go语言开发知识点，真正体系化！

由于文件比较多，这里只是将部分目录截图出来，全套包含大厂面经、学习笔记、源码讲义、实战项目、大纲路线、讲解视频，并且后续会持续更新

如果你需要这些资料，可以戳这里获取

			dont_counts += (dont_count ? 1 : -1);

		return;
		}
	}

src->InitSource();
Source\* s = new Source;
s->src = src;
s->dont_count = dont_count;
s->manage_lifetime = manage_lifetime;
if ( dont_count )
	++dont_counts;

sources.push\_back(s);

}

3. zeek::iosource::PktSrc::InitSource PktSrc.cc:137

void PktSrc::InitSource()
{
Open();
}
void PcapSource::Open()
{
if ( props.is_live )
OpenLive();
else
OpenOffline();
}

4. 打开网络接口

void PcapSource::OpenLive()
{
char errbuf[PCAP_ERRBUF_SIZE];

// Determine interface if not specified.
if ( props.path.empty() )
{
	pcap_if_t\* devs;

	if ( pcap\_findalldevs(&devs, errbuf) < 0 )
    {
		Error(util::fmt("pcap\_findalldevs: %s", errbuf));
		return;
    }

	if ( devs )
    {
		props.path = devs->name;
		pcap\_freealldevs(devs);

		if ( props.path.empty() )
        {
			Error("pcap\_findalldevs: empty device name");
			return;
        }
    }
	else
    {
		Error("pcap\_findalldevs: no devices found");
		return;
    }
}

// Determine network and netmask.
uint32\_t net;
if ( pcap\_lookupnet(props.path.c\_str(), &net, &props.netmask, errbuf) < 0 )
{
	// ### The lookup can fail if no address is assigned to
	// the interface; and libpcap doesn't have any useful notion
	// of error codes, just error std::strings - how bogus - so we
	// just kludge around the error :-(.
	// sprintf(errbuf, "pcap\_lookupnet %s", errbuf);
	// return;
	props.netmask = 0xffffff00;
}

#ifdef PCAP_NETMASK_UNKNOWN
// Defined in libpcap >= 1.1.1
if ( props.netmask == PCAP_NETMASK_UNKNOWN )
props.netmask = PktSrc::NETMASK_UNKNOWN;
#endif

pd = pcap\_create(props.path.c\_str(), errbuf);

if ( ! pd )
{
	PcapError("pcap\_create");
	return;
}

if ( pcap\_set\_snaplen(pd, BifConst::Pcap::snaplen) )
{
	PcapError("pcap\_set\_snaplen");
	return;
}

if ( pcap\_set\_promisc(pd, 1) )
{
	PcapError("pcap\_set\_promisc");
	return;
}

// We use the smallest time-out possible to return almost immediately
// if no packets are available. (We can't use set\_nonblocking() as
// it's broken on FreeBSD: even when select() indicates that we can
// read something, we may get nothing if the store buffer hasn't
// filled up yet.)
//
// TODO: The comment about FreeBSD is pretty old and may not apply
// anymore these days.
if ( pcap\_set\_timeout(pd, 1) )
{
	PcapError("pcap\_set\_timeout");
	return;
}

if ( pcap\_set\_buffer\_size(pd, BifConst::Pcap::bufsize \* 1024 \* 1024) )
{
	PcapError("pcap\_set\_buffer\_size");
	return;
}

if ( pcap\_activate(pd) )
{
	PcapError("pcap\_activate");
	return;
}

#ifdef HAVE_LINUX
if ( pcap_setnonblock(pd, 1, errbuf) < 0 )
{
PcapError(“pcap_setnonblock”);
return;
}
#endif

#ifdef HAVE_PCAP_INT_H
Info(util::fmt(“pcap bufsize = %d\n”, ((struct pcap*)pd)->bufsize));
#endif

props.selectable_fd = pcap\_get\_selectable\_fd(pd);

props.link_type = pcap\_datalink(pd);
props.is_live = true;

Opened(props);

}

5. 打开pcap文件

void PcapSource::OpenOffline()
{
char errbuf[PCAP_ERRBUF_SIZE];

pd = pcap\_open\_offline(props.path.c\_str(), errbuf);

if (!pd)
{
    Error(errbuf);
    return;
}

props.selectable_fd = fileno(pcap\_file(pd));

if (props.selectable_fd < 0)
    InternalError("OS does not support selectable pcap fd");

props.link_type = pcap\_datalink(pd);
props.is_live = false;

Opened(props);

}

### PcapDumper

class PcapDumper : public PktDumper
{
public:
PcapDumper(const std::string& path, bool append);
~PcapDumper() override;

static PktDumper\* Instantiate(const std::string& path, bool appen);

protected:
// PktDumper interface.
void Open() override;
void Close() override;
bool Dump(const Packet* pkt) override;

private:
Properties props;

bool append;
pcap_dumper_t\* dumper;
pcap_t\* pd;

};

#### 构造


1. init\_run

if ( pcap_output_file ) //输出
{
    const char\* writefile = pcap_output_file->data();
    pkt_dumper = iosource_mgr->OpenPktDumper(writefile, false);
    assert(pkt_dumper);

    if ( ! pkt_dumper->IsOpen() )
        reporter->FatalError("problem opening dump file %s (%s)", writefile,
                             pkt_dumper->ErrorMsg());

    if ( const auto& id = zeek::detail::global\_scope()->Find("trace\_output\_file") )
        id->SetVal(make\_intrusive<StringVal>(writefile));
    else
        reporter->Error("trace\_output\_file not defined");
}

2. OpenPktDumper

PktDumper* Manager::OpenPktDumper(const std::string& path, bool append)
{
std::pair<std::string, std::string> t = split_prefix(path);
std::string prefix = t.first;
std::string npath = t.second;

// Find the component providing packet dumpers of the requested prefix.

PktDumperComponent\* component = nullptr;

std::list<PktDumperComponent\*> all_components = plugin_mgr->Components<PktDumperComponent>();
for (const auto& c : all_components)
{
    if (c->HandlesPrefix(prefix))
    {
        component = c;
        break;
    }
}

if (!component)
    reporter->FatalError("type of packet dumper '%s' not recognized", prefix.c\_str());

// Instantiate packet dumper.
//调用构造
PktDumper\* pd = (\*component->Factory())(npath, append);
assert(pd);

if (!pd->IsOpen() && pd->IsError())
    // Set an error message if it didn't open successfully.
    pd->Error("could not open");

DBG\_LOG(DBG_PKTIO, "Created packer dumper of type %s for %s", component->Name().c\_str(), npath.c\_str());

pd->Init();
pkt_dumpers.push\_back(pd);

return pd;

}

3. 构造

iosource::PktDumper* PcapDumper::Instantiate(const std::string& path, bool append)
{
return new PcapDumper(path, append);
}

#### Init


1. Init

void PktDumper::Init()
{
Open();
}

2. Open

void PcapDumper::Open()
{
int linktype = -1;

pd = pcap\_open\_dead(DLT_EN10MB, BifConst::Pcap::snaplen);

if (!pd)
{
    Error("error for pcap\_open\_dead");
    return;
}

if (props.path.empty())
{
    Error("no filename given");
    return;
}

struct stat s;
int exists = 0;

if (append)
{
    // See if output file already exists (and is non-empty).
    exists = stat(props.path.c\_str(), &s);

    if (exists < 0 && errno != ENOENT)
    {
        Error(util::fmt("can't stat file %s: %s", props.path.c\_str(), strerror(errno)));
        return;
    }
}

if (!append || exists < 0 || s.st_size == 0)
{
    // Open new file.
    dumper = pcap\_dump\_open(pd, props.path.c\_str());
    if (!dumper)
    {
        Error(pcap\_geterr(pd));
        return;
    }
}

else
{

#ifdef HAVE_PCAP_DUMP_OPEN_APPEND
dumper = pcap_dump_open_append(pd, props.path.c_str());
#else
// Old file and we need to append, which, unfortunately,
// is not supported by libpcap. So, we have to hack a
// little bit, knowing that pcap_dumper_t is, in fact,
// a FILE … 😦
dumper = (pcap_dumper_t*)fopen(props.path.c_str(), “a”);
#endif
if (!dumper)
{
Error(util::fmt(“can’t open dump %s: %s”, props.path.c_str(), strerror(errno)));
return;
}
}

props.open_time = run_state::network_time;
Opened(props);

}

## Analyzer


![image.png](https://img-blog.csdnimg.cn/img\_convert/76495bce0676077e2119484ded85daa6.png#clientId=uce7ab961-f53a-4&crop=0&crop=0&crop=1&crop=1&from=paste&id=u1765d083&margin=[object Object]&name=image.png&originHeight=424&originWidth=999&originalType=url&ratio=1&rotation=0&showTitle=false&size=28441&status=done&style=none&taskId=u8a111149-90b9-4e89-bc7a-a948b823a04&title=)  
Zeek的动态分析框架是将分析器树与每个连接相关联。这棵树可以包含任意数量的分析器在各种群体，并且在连接的整个生命周期内都可以进行修改。并且zeek提供了两种关键的能力：


* 独立于端口进行协议分析。通过一组与协议内容匹配的特征，zeek可以通过器payload找到正确的分析器。当特征匹配时会使用对应的分析器。
* 当分析器解析错误的协议时，可以关闭分析器，并且我们可以使用多个分析器。


所有分析器都派生自类`Analyzer`。我们将 分析器树与每个连接相关联，它反映了数据包分析期间的数据流，分析器根据哪些分析器执行其分析。每个数据包首先被传递到树的根节点，该根节点将其（可能转换的）输入传递给它的所有子节点。每个孩子依次将数据传递给其继任者。


根节点必须始终是`TransportLayerAnalyzer`类型。例如`TCP`、`UDP`和`ICMP`分析器。应用层分析器要么派生自`TCP_ApplicationAnalyzer`（对于TCP 协议），要么派生自通用Analyzer类（对于所有非TCP 协议）。


当连接开始时，初始分析器树由全局`analyzer::Manager`实例化。初始树始终包含相应的`TransportLayerAnalyzer`。对于TCP和UDP，它还分别包含PIA\_TCP或PIA\_UDP类的实例。PIA 负责在连接进行时检测协议。最重要的是，它们执行签名匹配。根据是否使用任何已知端口，初始树可能立即包含也可能不包含任何应用层分析器。


分析器可以支持两种输入方法之一（或两者）：分组方式或流方式。分析器可以通过一种方法（例如，分组方式）接受输入，并通过另一种方法（例如，流方式）将其传递给它的孩子。例如TCP\_Analyzer将数据包重新组合成字节流，因此所有TCP\_ApplicationAnalyzer只能看到流式输入。



### Analyzer的接口

// 初始化analyzer
void Init()

// 清楚analyer
void Done()

//分组输入接口
// len 数据长度
// data 指向数据的指针
// orig 数据来自连接发起者为true
// seq 数据相关的序号，如果没有则为-1
// ip 如果有IP相关的数据包头，如果没有则为空
// caplen ip的长度？
void DeliverPacket(int len, const u_char\* data, bool orig, uint64 seq, const IP_Hdr\* ip, int caplen)
    
// 流式输入的接口 
// len 数据长度
// data 指向数据的指针
// orig 数据来自连接发起者为true
void DeliverStream(int len, const u_char\* data, bool orig)
    
// 取消seq的报文
void Undelivered(uint64 seq, int len, bool orig)
// 返回分析器当前使用的内存字节数。
unsigned int MemoryAllocation() const
// 返回分析器类的新实例
static Analyzer\* InstantiateAnalyzer(Connection\* conn)
// 如果分析器完全禁用并且不考虑任何连接，则返回 false。（通常情况下，如果没有为分析器定义事件处理程序，就会出现这种情况。）
static bool Available()
// 给定的端点是否已经传输完成
void EndpointEOF(bool is_orig)
// 每当端点进入TCP\_CLOSED或TCP\_RESET时调用。
void ConnectionFinished(int half_finished)
// 连接重置时调用 
void ConnectionReset()
// 每当看到RST数据包时调用（有时调用 ConnectionReset会延迟）
void PacketWithRST()

Analyzer如果构建？  
Analyzer如何调度，如何形成链式？  
 


## Connection


[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-pPXGuU0z-1660489984252)(https://cdn.nlark.com/yuque/\_\_puml/544ea3f957a363da4150f42434905c49.svg#lake\_card\_v2=eyJ0eXBlIjoicHVtbCIsImNvZGUiOiJAc3RhcnR1bWxcblxuY2xhc3MgT2JqIHtcblx0XG59XG5cblxuQGVuZHVtbCIsInVybCI6Imh0dHBzOi8vY2RuLm5sYXJrLmNvbS95dXF1ZS9fX3B1bWwvNTQ0ZWEzZjk1N2EzNjNkYTQxNTBmNDI0MzQ5MDVjNDkuc3ZnIiwiaWQiOiJRTTdFViIsIm1hcmdpbiI6eyJ0b3AiOnRydWUsImJvdHRvbSI6dHJ1ZX0sImNhcmQiOiJkaWFncmFtIn0=)]


## 启动



### run\_loop

void run_loop()
{
util::detail::set_processing_status(“RUNNING”, “run_loop”);

iosource::Manager::ReadySources ready;
ready.reserve(iosource_mgr->TotalSize());

while (iosource_mgr->Size() || (BifConst::exit_only_after_terminate && !terminating))
{
    time_updated = false;
    iosource_mgr->FindReadySources(&ready);

#ifdef DEBUG
static int loop_counter = 0;

    // If no source is ready, we log only every 100th cycle,
    // starting with the first.
    if (!ready.empty() || loop_counter++ % 100 == 0)
    {
        DBG\_LOG(DBG_MAINLOOP, "realtime=%.6f ready\_count=%zu", util::current\_time(), ready.size());

        if (!ready.empty())
            loop_counter = 0;
    }

#endif
current_iosrc = nullptr;
auto communication_enabled = broker_mgr->Active();

    if (!ready.empty())
    {
        for (const auto& src : ready)
        {
            auto\* iosrc = src.src;

            DBG\_LOG(DBG_MAINLOOP, "processing source %s", iosrc->Tag());
            current_iosrc = iosrc;
            if (iosrc->ImplementsProcessFd() && src.fd != -1)
                iosrc->ProcessFd(src.fd, src.flags);
            else
                iosrc->Process();
        }
    }
    else if ((have_pending_timers || communication_enabled || BifConst::exit_only_after_terminate) && !pseudo_realtime)
    {
        // Take advantage of the lull to get up to
        // date on timers and events. Because we only
        // have timers as sources, going to sleep here
        // doesn't risk blocking on other inputs.
        update\_network\_time(util::current\_time());
        expire\_timers();
    }

    // Ensure that the time gets updated every pass if we're reading live.
    // This is necessary for e.g. packet sources that don't have a selectable
    // file descriptor. They'll always be ready on a very short timeout, but
    // won't necessarily have a packet to process. In these case, sometimes
    // the time won't get updated for a long time and timers don't function
    // correctly.
    if ((!time_updated && reading_live))
    {
        update\_network\_time(util::current\_time());
        expire\_timers();
    }

    event_mgr.Drain();

    processing_start_time = 0.0; // = "we're not processing now"
    current_dispatched = 0;
    current_iosrc = nullptr;

    if (::signal_val == SIGTERM || ::signal_val == SIGINT)
        // We received a signal while processing the
        // current packet and its related events.
        // Should we put the signal handling into an IOSource?
        zeek\_terminate\_loop("received termination signal");

    if (!reading_traces)
        // Check whether we have timers scheduled for
        // the future on which we need to wait.
        have_pending_timers = zeek::detail::timer_mgr->Size() > 0;

    if (pseudo_realtime && communication_enabled)
    {
        auto have_active_packet_source = false;

        iosource::PktSrc\* ps = iosource_mgr->GetPktSrc();
        if (ps && ps->IsOpen())
            have_active_packet_source = true;

        if (!have_active_packet_source)
            // Can turn off pseudo realtime now
            pseudo_realtime = 0.0;
    }
}

// Get the final statistics now, and not when finish\_run() is
// called, since that might happen quite a bit in the future
// due to expiring pending timers, and we don't want to ding
// for any packets dropped beyond this point.
get\_final\_stats();

}

### Process

void PktSrc::Process()
{
if (!IsOpen())
return;

if (!ExtractNextPacketInternal())
    return;

run_state::detail::dispatch\_packet(&current_packet, this);

have_packet = false;
DoneWithPacket();

}

#### ExtractNextPacketInternal

bool PktSrc::ExtractNextPacketInternal()
{
if (have_packet)
return true;

have_packet = false;

// Don't return any packets if processing is suspended (except for the
// very first packet which we need to set up times).
if (run_state::is\_processing\_suspended() && run_state::detail::first_timestamp)
    return false;

if (run_state::pseudo_realtime)
    run_state::detail::current_wallclock = util::current\_time(true);

if (ExtractNextPacket(&current_packet))
{
    if (current_packet.time < 0)
    {
        Weird("negative\_packet\_timestamp", &current_packet);
        return false;
    }

    if (!run_state::detail::first_timestamp)
        run_state::detail::first_timestamp = current_packet.time;

    have_packet = true;
    return true;
}

if (run_state::pseudo_realtime && !IsOpen())
{
    if (broker_mgr->Active())
        iosource_mgr->Terminate();
}

return false;

}

bool PcapSource::ExtractNextPacket(Packet* pkt)
{
if (!pd)
return false;

const u_char\* data;
pcap_pkthdr\* header;

int res = pcap\_next\_ex(pd, &header, &data);

switch (res)
{
case PCAP_ERROR_BREAK: // -2
    // Exhausted pcap file, no more packets to read.
    assert(!props.is_live);
    Close();
    return false;
case PCAP_ERROR: // -1
    // Error occurred while reading the packet.
    if (props.is_live)
        reporter->Error("failed to read a packet from %s: %s", props.path.data(), pcap\_geterr(pd));
    else
        reporter->FatalError("failed to read a packet from %s: %s", props.path.data(), pcap\_geterr(pd));
    return false;
case 0:
    // Read from live interface timed out (ok).
    return false;
case 1:
    // Read a packet without problem.
    // Although, some libpcaps may claim to have read a packet, but either did
    // not really read a packet or at least provide no way to access its
    // contents, so the following check for null-data helps handle those cases.
    if (!data)
    {
        reporter->Weird("pcap\_null\_data\_packet");
        return false;
    }
    break;
default:
    reporter->InternalError("unhandled pcap\_next\_ex return value: %d", res);
    return false;
}

pkt->Init(props.link_type, &header->ts, header->caplen, header->len, data);

if (header->len == 0 || header->caplen == 0)
{
    Weird("empty\_pcap\_header", pkt);
    return false;
}

++stats.received;
stats.bytes_received += header->len;

// Some versions of libpcap (myricom) are somewhat broken and will return a duplicate
// packet if there are no more packets available. Namely, it returns the exact same
// packet structure (including the header) out of the library without reinitializing
// any of the values. If we set the header lengths to zero here, we can keep from
// processing it a second time.
header->len = 0;
header->caplen = 0;

return true;

}

#### dispatch\_packet

void dispatch_packet(Packet* pkt, iosource::PktSrc* pkt_src)
{
double t = run_state::pseudo_realtime ? check_pseudo_time(pkt) : pkt->time;

if (!zeek_start_network_time)
{
    zeek_start_network_time = t;

    if (network_time_init)
        event_mgr.Enqueue(network_time_init, Args{});
}

current_iosrc = pkt_src;

#pragma GCC diagnostic push
#pragma GCC diagnostic ignored “-Wdeprecated-declarations”
current_pktsrc = pkt_src;
#pragma GCC diagnostic pop

// network\_time never goes back.
update\_network\_time(zeek::detail::timer_mgr->Time() < t ? t : zeek::detail::timer_mgr->Time());
processing_start_time = t;
expire\_timers();

zeek::detail::SegmentProfiler\* sp = nullptr;

if (load_sample)
{
    static uint32\_t load_freq = 0;

    if (load_freq == 0)
        load_freq = uint32\_t(0xffffffff) / uint32\_t(zeek::detail::load_sample_freq);

    if (uint32\_t(util::detail::random\_number() & 0xffffffff) < load_freq)
    {
        // Drain the queued timer events so they're not
        // charged against this sample.
        event_mgr.Drain();

        zeek::detail::sample_logger = new zeek::detail::SampleLogger();
        sp = new zeek::detail::SegmentProfiler(zeek::detail::sample_logger, "load-samp");
    }
}
//处理包
packet_mgr->ProcessPacket(pkt);
event_mgr.Drain();

if (sp)
{
    delete sp;
    delete zeek::detail::sample_logger;
    zeek::detail::sample_logger = nullptr;
}

processing_start_time = 0.0; // = "we're not processing now"
current_dispatched = 0;

if (pseudo_realtime && !first_wallclock)
    first_wallclock = util::current\_time(true);

current_iosrc = nullptr;

#pragma GCC diagnostic push
#pragma GCC diagnostic ignored “-Wdeprecated-declarations”
current_pktsrc = nullptr;
#pragma GCC diagnostic pop
}

#### process\_packet

void Manager::ProcessPacket(Packet* packet)
{
#ifdef DEBUG
static size_t counter = 0;
DBG_LOG(DBG_PACKET_ANALYSIS, “Analyzing packet %ld, ts=%.3f…”, ++counter, packet->time);
#endif

zeek::detail::SegmentProfiler prof(detail::segment_logger, "dispatching-packet");
if (pkt_profiler)
    pkt_profiler->ProfilePkt(zeek::run_state::processing_start_time, packet->cap_len);

++num_packets_processed;

bool dumped_packet = false;
if (packet->dump_packet || zeek::detail::record_all_packets)
{
    DumpPacket(packet, packet->dump_size);
    dumped_packet = true;
}

// Start packet analysis
root_analyzer->ForwardPacket(packet->cap_len, packet->data, packet, packet->link_type);

if (!packet->processed)
{
    if (packet_not_processed)
        event_mgr.Enqueue(packet_not_processed, Packet::ToVal(packet));

    plugin_mgr->HookUnprocessedPacket(packet);

    if (unprocessed_dumper)
        unprocessed_dumper->Dump(packet);

    total_not_processed++;
}

if (raw_packet)
    event_mgr.Enqueue(raw_packet, packet->ToRawPktHdrVal());

// Check whether packet should be recorded based on session analysis
if (packet->dump_packet && !dumped_packet)
    DumpPacket(packet, packet->dump_size);

}

#### ForwardPacket

bool Analyzer::ForwardPacket(size_t len, const uint8_t* data, Packet* packet) const
{
AnalyzerPtr inner_analyzer = nullptr;

for (const auto& child : analyzers_to_detect)
{
    if (child->DetectProtocol(len, data, packet))
    {
        DBG\_LOG(DBG_PACKET_ANALYSIS, "Protocol detection in %s succeeded, next layer analyzer is %s", GetAnalyzerName(),
                child->GetAnalyzerName());
        inner_analyzer = child;
        break;
    }
}

if (!inner_analyzer)
    inner_analyzer = default_analyzer;

if (!inner_analyzer)
{
    DBG\_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s stopped, no default analyzer available.", GetAnalyzerName());

    if (report_unknown_protocols)
        Weird("no\_suitable\_analyzer\_found", packet);

    return false;
}

return inner_analyzer->AnalyzePacket(len, data, packet);

}

#### EthernetAnalyzer::AnalyzePacket

bool EthernetAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
{
// Make sure that we actually got an entire ethernet header before trying
// to pull bytes out of it.
if (16 >= len)
{
Weird(“truncated_ethernet_frame”, packet);
return false;
}

// Skip past Cisco FabricPath to encapsulated ethernet frame.
if (data[12] == 0x89 && data[13] == 0x03)
{
    auto constexpr cfplen = 16;

    if (cfplen + 14 >= len)
    {
        Weird("truncated\_link\_header\_cfp", packet);
        return false;
    }

    data += cfplen;
    len -= cfplen;
}

// Get protocol being carried from the ethernet frame.
uint32\_t protocol = (data[12] << 8) + data[13];

packet->eth_type = protocol;
packet->l2_dst = data;
packet->l2_src = data + 6;

// Ethernet II frames
if (protocol >= 1536)
    return ForwardPacket(len - 14, data + 14, packet, protocol);

// Other ethernet frame types
if (protocol <= 1500)
{
    if (16 >= len)
    {
        Weird("truncated\_ethernet\_frame", packet);
        return false;
    }

    // Let specialized analyzers take over for non Ethernet II frames.
    // Note that pdata remains at the start of the ethernet frame.

    AnalyzerPtr eth_analyzer = nullptr;

    if (data[14] == 0xAA && data[15] == 0xAA)
        // IEEE 802.2 SNAP
        eth_analyzer = SNAPAnalyzer;
    else if (data[14] == 0xFF && data[15] == 0xFF)
        // Novell raw IEEE 802.3
        eth_analyzer = NovellRawAnalyzer;
    else
        // IEEE 802.2 LLC
        eth_analyzer = LLCAnalyzer;

    if (eth_analyzer)
        return eth_analyzer->AnalyzePacket(len, data, packet);

    return true;
}

// Undefined (1500 < EtherType < 1536)
Weird("undefined\_ether\_type", packet);
return false;

}

#### IPAnalyzer::AnalyzePacket

bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
{
// Check to make sure we have enough data left for an IP header to be here. Note we only
// check ipv4 here. We’ll check ipv6 later once we determine we have an ipv6 header.
if (len < sizeof(struct ip))
{
Weird(“truncated_IP”, packet);
return false;
}

int32\_t hdr_size = static\_cast<int32\_t>(data - packet->data);

// Cast the current data pointer to an IP header pointer so we can use it to get some
// data about the header.
auto ip = (const struct ip\*)data;
uint32\_t protocol = ip->ip_v;

// This is a unique pointer because of the mass of early returns from this method.
if (protocol == 4)
{
    packet->ip_hdr = std::make\_shared<IP\_Hdr>(ip, false);
    packet->l3_proto = L3_IPV4;
}
else if (protocol == 6)
{
    if (len < sizeof(struct ip6\_hdr))
    {
        Weird("truncated\_IP", packet);
        return false;
    }

    packet->ip_hdr = std::make\_shared<IP\_Hdr>((const struct ip6\_hdr\*)data, false, len);
    packet->l3_proto = L3_IPV6;
}
else
{
    Weird("unknown\_ip\_version", packet);
    return false;
}

// If there's an encapsulation stack in this packet, meaning this packet is part of a chain
// of tunnels, make sure to store the IP header in the last flow in the stack so it can be
// used by previous analyzers as we return up the chain.
if (packet->encap)
{
    if (auto\* ec = packet->encap->Last())
        ec->ip_hdr = packet->ip_hdr;
}

const struct ip\* ip4 = packet->ip_hdr->IP4\_Hdr();

// TotalLen() returns the full length of the IP portion of the packet, including
// the IP header and payload.
uint32\_t total_len = packet->ip_hdr->TotalLen();
if (total_len == 0)
{
    // TCP segmentation offloading can zero out the ip\_len field.
    Weird("ip\_hdr\_len\_zero", packet);

    if (detail::ignore_checksums)
        // Cope with the zero'd out ip\_len field by using the caplen.
        total_len = packet->cap_len - hdr_size;
    else
        // If this is caused by segmentation offloading, the checksum will
        // also be incorrect. If checksum validation is enabled - jus tbail here.
        return false;
}

if (packet->len < total_len + hdr_size)
{
    Weird("truncated\_IPv6", packet);
    return false;
}

// For both of these it is safe to pass ip\_hdr because the presence
// is guaranteed for the functions that pass data to us.
uint16\_t ip_hdr_len = packet->ip_hdr->HdrLen();
if (ip_hdr_len > total_len)
{
    Weird("invalid\_IP\_header\_size", packet);
    return false;
}

if (ip_hdr_len > len)
{
    Weird("internally\_truncated\_header", packet);
    return false;
}

if (packet->ip_hdr->IP4\_Hdr())
{
    if (ip_hdr_len < sizeof(struct ip))
    {
        Weird("IPv4\_min\_header\_size", packet);
        return false;
    }
}
else
{
    if (ip_hdr_len < sizeof(struct ip6\_hdr))
    {
        Weird("IPv6\_min\_header\_size", packet);
        return false;
    }
}

// Ignore if packet matches packet filter.
detail::PacketFilter\* packet_filter = packet_mgr->GetPacketFilter(false);
if (packet_filter && packet_filter->Match(packet->ip_hdr, total_len, len))
    return false;

if (!packet->l2_checksummed && !detail::ignore_checksums && ip4
    && !IPBasedAnalyzer::GetIgnoreChecksumsNets()->Contains(packet->ip_hdr->IPHeaderSrcAddr())
    && detail::in\_cksum(reinterpret\_cast<const uint8\_t\*>(ip4), ip_hdr_len) != 0xffff)
{
    Weird("bad\_IP\_checksum", packet);
    return false;
}

if (discarder && discarder->NextPacket(packet->ip_hdr, total_len, len))
    return false;

detail::FragReassembler\* f = nullptr;

if (packet->ip_hdr->IsFragment())
{
    packet->dump_packet = true; // always record fragments

    if (len < total_len)
    {
        Weird("incompletely\_captured\_fragment", packet);

        // Don't try to reassemble, that's doomed.
        // Discard all except the first fragment (which
        // is useful in analyzing header-only traces)
        if (packet->ip_hdr->FragOffset() != 0)
            return false;
    }
    else
    {
        f = detail::fragment_mgr->NextFragment(run_state::processing_start_time, packet->ip_hdr, packet->data + hdr_size);
        std::shared_ptr<IP_Hdr> ih = f->ReassembledPkt();

        if (!ih)
            // It didn't reassemble into anything yet.
            return true;

既有适合小白学习的零基础资料，也有适合3年以上经验的小伙伴深入学习提升的进阶课程，涵盖了95%以上Go语言开发知识点，真正体系化！

由于文件比较多，这里只是将部分目录截图出来，全套包含大厂面经、学习笔记、源码讲义、实战项目、大纲路线、讲解视频，并且后续会持续更新

如果你需要这些资料，可以戳这里获取

et->ip_hdr->IsFragment())
{
packet->dump_packet = true; // always record fragments

    if (len < total_len)
    {
        Weird("incompletely\_captured\_fragment", packet);

        // Don't try to reassemble, that's doomed.
        // Discard all except the first fragment (which
        // is useful in analyzing header-only traces)
        if (packet->ip_hdr->FragOffset() != 0)
            return false;
    }
    else
    {
        f = detail::fragment_mgr->NextFragment(run_state::processing_start_time, packet->ip_hdr, packet->data + hdr_size);
        std::shared_ptr<IP_Hdr> ih = f->ReassembledPkt();

        if (!ih)
            // It didn't reassemble into anything yet.
            return true;

[外链图片转存中…(img-FHvMX3bo-1715574187425)]
[外链图片转存中…(img-wWuEKME2-1715574187425)]
[外链图片转存中…(img-UezAgu79-1715574187425)]

既有适合小白学习的零基础资料，也有适合3年以上经验的小伙伴深入学习提升的进阶课程，涵盖了95%以上Go语言开发知识点，真正体系化！

由于文件比较多，这里只是将部分目录截图出来，全套包含大厂面经、学习笔记、源码讲义、实战项目、大纲路线、讲解视频，并且后续会持续更新

如果你需要这些资料，可以戳这里获取