OmniPeek Support

OmniPeek Plugin, processing embedded packets

dhamilton
Posts: 1
Joined: Fri Jul 25, 2008 1:39 pm

OmniPeek Plugin, processing embedded packets

Postby dhamilton » Fri Jul 25, 2008 1:49 pm

Is there anyway from the plugin code (during the ProcessPacket), to push a new packet to be processed. Is this what InsertPacket is for, because it doesn't appear to work.

For example, i have a UDP packet that has a 802.3 packet embedded within it. After processing the UDP portion during the ProcessPacket and the GetPacketString, i would like the 802.3 packet to be processed by the appropriate plugin for statistics and to fetch the summary string and append it to the UDP portion of the summary string.

Spacepacket
Posts: 78
Joined: Thu May 22, 2008 9:36 am

OmniPeek Plugin, processing embedded packets

Postby Spacepacket » Mon Jul 28, 2008 10:07 am

Yes, InsertPacket is used to insert packets into the capture. It is actually called DoInsertPacket(). It does work, so one of your parameters may be wrong. What is the return value? Post a snippet, and we can advise.

Also, if you do not want your original packets to appear, you can create an analysis module filter, process the packets through OnFilter() and insert the new packets there.

To reject the original packet and accept the new packet, the trick is to set a boolean member variable to true before your insert the new packet, and on OnFilter() test the variable for true and accept the packet.

You must do this because inserting a packet on OnFilter runs the new packet back through OnFilter, all on the same thread.


Return to “OmniPeek Support”

Who is online

Users browsing this forum: Bing [Bot] and 1 guest