The ONL Tutorial

Tutorial >> More Plugins

TOC

Drop Packets

You may want to drop a packet because:

• The plugin is acting as a passive monitor and is receiving a copy of the original packet (i.e., the packet matched an auxiliary filter);
• A policy specifies that certain packets be dropped; or
• The packet would be a danger to the network (e.g., the packet contains a virus).

• Remove the packet from the list of incoming packets
• Free the buffer memory

The stats plugin (shown below) does this in lines 14 and 15.

 1  void stats_handle_packet (
 2  	struct rp_instance *this,	// pointer to instance structure
 3  	void *bufferList		// pointer to list of pkt buffers
 4  ) {
 5      struct stats_instance *inst = (struct stats_instance *) this;
 6      msr_bufhdr_t	*buffer = msr_firstBuffer(bufferList);
 7      struct ip	*iph    = msr_pkt_iph(buffer);
 8      int		proto   = msr_ipproto(iph);
 9
10      if (proto == 1)		{ inst->icmpCnt++; inst->icmpTot++; }
11      else if (proto == 6)	{ inst->tcpCnt++; inst->tcpTot++;   }
12      else if (proto == 17)	{ inst->udpCnt++; inst->udpTot++;   }
13
14      msr_removeBuffer(bufferList, buffer);	// remove pkt from input list
15      msr_freeBuffer(buffer);			// free buffer
16  }

The header file ~onl/wu_arl/msr/rp/plugins/include/plugin_utils.h also defines the three functions msr_firstBuffer(...), msr_pkt_iph(...) and msr_ipproto(...) used in lines 6-8. The handle_packet parameter bufferList points to a list of packet buffers that are being passed into the plugin. Fig. 1 shows the structures accessed by this pointer including the format of a buffer itself. Typically, this list will contain exactly one packet.

Fig. 1. Packet Buffer.

Since the stats plugin receives duplicate packets from an auxiliary filter, the SPC would be passing duplicate packets back to the FPX if the packets were not removed from bufferList. Also, if the buffer memory were not freed, the SPC kernel would eventually run out of memory to allocate.

Tutorial >> More Plugins	TOC