A packet that has been captured or read from a file and decoded. This is the main interface for accessing packet information and content. The methods {@link #getHeader} and {@link #getMetaPacket} provide access to decodedcontents of the packet. The decoding proccess is implementation dependent as to exactly when it happens. The most efficient way is to decode only what is needed to fulfill any given request. Packet content may or may not have been decoded during packet aquisition (reading from file or live capture.) Some packet contents may have been decoded due inorder to evaluate complex filter expressions, or some other such reason. For the most part though the user can assume that no or just minimal decoding of the packet contents has taken place.
Packet decoding is done using the current codec registered for each protocol in the protocol registry. Protocol decoding is done according to the currently set protocol decoding defaults in the protocol registry. The default is to do on-demand protocol decoding which triggers protocol header decoding only when such a header is accessed such as a header interation/traversal or direct call to getHeader.
The headers returned are backed by the packet buffer which contains all of the packet's content. Any changes to the packet's buffer or through the individual header interface must be followed by a call to {@link #update}which will cause the previosly returned packet state to be discarded and redecoded. Changes to the packet's or header's buffers can have global consequences within a packet as protocol binding may have been altered or other fields that have dependencies on them. Therefore after each call that modifies the content of the packet buffer you should call update inorder to sychronize the state of the packet structure with the packet buffer. Using and invalidated header due to packet buffer changes may throw IllegalStateException or override some other portion of the packet buffer content.
All operations wheather immutable or mutable are done on the packet buffer. There are numerous ways to modify this packet buffer either directly, through the Packet or PcapBlockHeader API or indirectly outside the current API. All changes should be synchronized after the updates are complete with an update call which will redecode the packet buffer using all the know protocol and NPL definitions.
Lastly, notice that you are able to modify the packet contents that came from a read-only file. This means that although you can modify the packet content, you are not able to flush the changes to a file and you will get an error.
@author Mark Bednarczyk @author Sly Technologies, Inc. | |
| |
| |