libnetdude Concepts

Table of Contents
Trace Files
Packets
Protocols and Protocol Plugins
Trace parts and Trace part managers
Packet iterators
Packet filters
Feature plugins

This chapter introduces the main concepts of libnetdude, explains how the features are implemented, and how the code is used. The next chapter illustrates the concepts in a few examples.


Trace Files

Trace files are libnetdude's bread and butter. They are represented by instances of LND_Trace, which maintain state for each trace file the user is manipulating. State information consists of consistency management, filter settings, packet iteration configuration, modification status and other items. See libnd_trace.h for details.

To allow tools to seamlessly integrate libnetdude, you can register observers for each trace that will then receive notifications when certain events occur on a trace file. A good example are GUI-based applications — these can register an observer to update the GUI whenever the trace is modified, for example.

Instantiating a trace structure is done using libnd_trace_new(), passing it the path of the trace file to load or %NULL when you want to create a new file. Saving is done using libnd_trace_save() and libnd_trace_save_as(), and releasing a trace is done using libnd_trace_free().

When you open a trace file, libnetdude does not load any packets. If you want to load any packets, from what part of the file, and how many packets is entirely up to you. This is explained in detail in the section on trace parts below.

Every trace has an active trace area that can be easily iterated over. Trace areas are defined in one of two ways, in terms of start- and end timestamps (e.g., from 08:00:00 to 08:10:30 on August 4) or start- and end fractions (e.g., from 0.5 to 1.0, that is, from the middle of the file to its end). You can set and obtain this area using libnd_trace_set_area() and libnd_trace_get_area().

To associate arbitrary data items with a trace, every trace comes with a simple key/value-based data storage, accessible through libnd_trace_get_data, libnd_trace_set_data, and libnd_trace_del_data.