Layer
- Description
- Methods

Layer

Description

The layer object represents a protocol layer within a packet. For example an HTTP packet may have “Ethernet” , “IP”, “TCP”, “HTTP” layers. These are modeled using the Layer object

Name	Type	Access	Description
Name	String	Read	The name of the layer. This is usually the short name of the protocol.
ProtID	String	Read	The GUID of the protocol layer. The GUID is returned as a string in Registry format. You may recall that in the Unsniff plugin architecture each protocol must be assigned a unique GUID.
Size	Long	Read	The number of bytes in this layer.
Fields	Collection	Read	Get all the fields contained in this layer. This is a collection. For example: In the Ethernet layer: you may have the “Dest MAC,”Src MAC”, “Ethertype” fields. This is your main method to drilldown to field level details from a packet.

Methods

Name

Parameters

Description

FindField

FieldName(String)

Find a field in this layer using a field name.The field name must be as it appears in Unsniff. This method returns the first field that matches the name.All sub fields are searched for a match.
Example:

Set IpSrc = iplayer.FindField(“Src Address”)

This method also allows you to specifically search fields within records using a special notation. Notation: “>Group 1>Sub Group2> MyField”.There is no limit on the number of groups that can be nested this way. When you use this notation, FindField will search “Group 1” for a field named “Sub Group2”, then search “Sub Group 2” for a field named “MyField”. Use this method to disambiguate duplicate field names or to cut down on exhaustive searches.
Example:

Set Fbit = iax.FindField(“>FULL FRAME>Source  Call Number>F”)

You can also use the notation to select the nth instance of a field. To select the IP Address field in the 2nd occurance of the Address Record

 Set IP2 = arplayer.FindField(">Address Record[1]>IP Address")

RawData

String

A hex dump of bytes in this layer only