Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
L2TP decapsulation for PF_RING
if (h->extended_hdr.parsed_pkt.l3_proto == 115) {
struct pfring_pkthdr l2tp_header;
memset(&l2tp_header, 0, sizeof(l2tp_header));
int16_t l4_offset = h->extended_hdr.parsed_pkt.offset.l4_offset;
// L2TP has two headers: L2TP and default L2-Specific Sublayer: every header for 4bytes
int16_t l2tp_header_size = 8;
l2tp_header.len = h->len - (l4_offset + l2tp_header_size);
l2tp_header.caplen = h->caplen - (l4_offset + l2tp_header_size);
const u_char *l2tp_tunnel_payload = p + l4_offset + l2tp_header_size;
pfring_parse_pkt((u_char*)l2tp_tunnel_payload, &l2tp_header, 4, 0, 0);
// Copy data back
memcpy((struct pfring_pkthdr*)h, &l2tp_header, sizeof(l2tp_header));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.