Implementing new protocol + parsing

80 views
Skip to first unread message

martin...@gmail.com

unread,
Feb 7, 2020, 5:54:40 PM2/7/20
to PcapPlusPlus support
Hi, I would like some help in implementing parsing a new protocol (IEC 61850 SV) as it is currently not supported. Here is an example of such a packet. I've looked at the documentation and have identified parts to edit: protocoltype.h for the protocol and ethlayer.h for the ethertype. What I am stuck at is how to implement this after the ethernet layer, as I notice that each particular 'layer' class looks for varying next layers (from findnextlayer()) . I think there needs to be a new struct + class as well as a header file.

Another question is how can I take a raw data packet and extract individual TLVs from the raw data?

Thanks.

martin...@gmail.com

unread,
Feb 7, 2020, 5:59:30 PM2/7/20
to PcapPlusPlus support
I see a computecalculatefields() but not sure how to edit it.

martin...@gmail.com

unread,
Feb 7, 2020, 6:01:29 PM2/7/20
to PcapPlusPlus support
Also as a note, I'm fairly new to C++.

PcapPlusPlus Support

unread,
Feb 11, 2020, 4:57:53 AM2/11/20
to martin...@gmail.com, PcapPlusPlus support
Hi,

I'm sorry for the late response.
Basically what you need to do is to create a new class that inherits from "Layer" and implement the abstract methods which are:  parseNextLayer,  getHeaderLencomputeCalculateFieldstoString,  getOsiModelLayer.

You can take VlanLayer as an example and implement something similar.

Then you need to make the changes you mentioned in ProtocolType.h and EthLayer.h

Last you need to parse your new layer right after EthernetII. To do that take a look at EthLayer::parseNextLayer: you need to initiate a new instance of your layer if the correct EtherType comes. See how the other layers are initiated there.

You can try implementing that, I will help in every way I can.

Thanks,

On Fri, Feb 7, 2020 at 3:01 PM <martin...@gmail.com> wrote:
Also as a note, I'm fairly new to C++.

--
You received this message because you are subscribed to the Google Groups "PcapPlusPlus support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pcapplusplus-sup...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pcapplusplus-support/9792a139-b152-4d15-8169-9a414dac6ec2%40googlegroups.com.
Reply all
Reply to author
Forward
0 new messages