Skip to content

Commit 8ff932c

Browse files
BenoitBenoit
authored andcommitted
Updated README and docs
1 parent 3b2a8e3 commit 8ff932c

File tree

2 files changed

+15
-1
lines changed

2 files changed

+15
-1
lines changed

DEVGUIDE.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,19 @@ func (WiregoExample) GetDetectionHeuristicsParents() []string {
104104
}
105105
```
106106

107+
When using detection heuristics mode, if a packet matches the "heuristics parent" previously defined, a detection function will be called. Return true if the packet is yours and false otherwise.
108+
109+
```golang
110+
func (WiregoExample) DetectionHeuristic(packetNumber int, src string, dst string, layer string, packet []byte) bool {
111+
//All packets starting with 0x00 should be passed to our dissector (super advanced heuristic)
112+
if len(packet) != 0 && packet[0] == 0x00 {
113+
return true
114+
}
115+
return false
116+
}
117+
```
118+
119+
107120
The most interesting part is the DissectPacket function, where you will implement your parser:
108121

109122
```golang

README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ For **step 2**, you will basically just have to __import "wirego"__ and implemen
3939
Setup() error
4040
GetFields() []WiresharkField
4141
GetDetectionFilters() []DetectionFilterType
42-
GetDetectionHeuristicsParent() []string
42+
GetDetectionHeuristicsParent() []string
43+
DetectionHeuristic(packetNumber int, src string, dst string, stack string, packet []byte) bool
4344
DissectPacket(packetNumber int, src string, dst string, stack string, packet []byte) *DissectResult
4445
}
4546
```

0 commit comments

Comments
 (0)