packet packetName ?size? packetName

Creates the packet named 'packetName' with the given size (default is MTU).

packetName (re)size ?size? size of the packet

Without arguments, returns the current size. With one argument, set the size of the packet. If you reduce the size, the bytes are lost ; if you raise the size, the new bytes are initialize to 0.

packetName fill value value used

Fill the packet memory with value (value in a byte).

packetName getchar/get8 ?-offset n? packetName getshort/get16 ?-offset n -littleendian? packetName getint/get32 ?-offset n -littleendian? packetName getbytes ?-offset n -size n? packetName gettext ?-offset n -size n? packetName getstring ?-offset n? value value value string string zero terminated string

Extract the data from the packet either as one char (8 bits), one short (16 bits) or one int (32 bits) or as one string (in Tcl meaning with possible embedded null char), one text with non printable characters espaced with \x?? or a C string (0 terminated). The position of the data to read can be specified with -offset, and when working with a string the size with -size. By default, offset is set to zero and size to the whole packet.

packetName setfrom string packetName setchar/set8 ?-offset n? numericalValue packetName setshort/set16 ?-offset n -littleendian? numericalValue packetName setint/set32 ?-offset n -littleendian? numericalValue packetName setbytes ?-offset n -size n? string new size of packet 1 2 4 transfered bytes

Commands similar to the "get" serie.

packetName clone packetToClone new size of packet

Clone the content of a packet (makes a copy of packetToClone's memory). The mappers from the source packet are re-created in the cloned packet.

packetName find ?-offset n -size n? pattern packetName rfind ?-offset n -size n? pattern offset or -1 offset or -1

Try to locate the given pattern in the packet memory. The offset of the first occurence is returned or -1 if no occurence was found. The position from where to start the search can be specified with the -offset option and the maximum size to scan with the -size option. By default, the whole packet memory is scanned.

packetName match filter 0/1

Try to find if a packet match the defined filter (see the network documentation to see the filter definition and configuration).

After the management of the packet's memory, let's see how to deal with mappers.

mappers list of all known mappers

List all the mappers currently registred within GAPS.

packetName newmapper mapperName ?-offset n -parent mapper -setdefaults? packetName deletemappers ?mapperName ...? packetName mappers name of the new mapper list of packet mappers list of packet mappers

To create a new mapper, use the newmapper command. the mapperName must be the name of a mapper (as returned by the mappers command). By default, the new mapper is automatically appended to the last mapper (offset computed by GASP), but you can force the offset by using the -offset option. The default parent (preceding mapper) can be overwritten for the starting mapper. When creating a mapper, you can write the memory to default values (as specified in the mapper definition) using the -setdefaults option. To delete a mapper, use the deletemapper command. If no name is given, all the mappers are deleted (the deletion of a mapper does not affect the packet memory). To list the mappers currently applied to a packet, use the mappers command.

packetName decodefrom mapperName ?-offset offset -parent mapper? total size of the decoded part

Use this command to automate the decoding of a set of nested mappers. For example, in networks protocols the type of the next layer is indicated. The command construct a list (stack) of mappers using the known mappers : the process stops as soon as the "next layer" mapper is unknown. If no offset is specified, then all the mappers are destroyed and the decoding starts from 0, else the decoding starts at offset and the mappers are added to the existing ones. The default parent (preceding mapper) can be overwritten for the starting mapper. Calling this function will execute the predecode and postdecode script if they are defined (see in the mapper language definition for the meaning of this scripts).

packetName data string ?offset? nb bytes set in data

This provide a way to access the packet memory located just after the last mapper. This correspond to the user data in a network packet. You can set this memory, the string given in argument is written byte per byte in the packet memory. If the string is longer than the size of the packet memory, the remaining chars are discarded.