Expand description
Phase 4: Packet-level transformations applied during the sort second pass.
Transformations are applied in this order for each packet:
- IP address mapping — replace IP addresses in-place or re-frame the packet when the mapping is cross-family (IPv4↔IPv6).
- Payload truncation — shorten the payload and update length fields.
- Checksum recalculation — recompute Layer 3 (IP) and Layer 4 (TCP/UDP) checksums whenever the above steps modified the packet bytes.
Timestamp shifting is computed once before the loop and applied per-packet without touching the byte payload.
Only Ethernet frames (link type 1) carrying IPv4 or IPv6 are supported. A single 802.1Q VLAN tag is transparently handled. Other link types and encapsulations are passed through untouched.
§Cross-family IP mapping
When a mapping changes the IP version of an address (e.g. 10.0.0.1=::1),
the entire Ethernet payload must be re-framed:
- IPv4 → IPv6: The packet gains a 40-byte IPv6 header (vs. the original
≥20-byte IPv4 header). Unmapped IPv4 addresses are embedded as
IPv4-mapped IPv6 addresses (
::ffff:a.b.c.d). - IPv6 → IPv4: The packet shrinks by 20 bytes (IPv6 40 B → IPv4 20 B).
Unmapped IPv6 addresses must be IPv4-mapped (
::ffff:a.b.c.d); if they are not, the re-frame is skipped and the packet is passed through unchanged.
After re-framing, all checksums are recalculated using the new pseudo-header.
Structs§
- IpMapping
- One IP address replacement rule.
- Protocol
Truncation - A per-protocol payload truncation rule.
- Transform
Options - All packet-level transformation options for a sort run.
Enums§
- Transform
Error - Errors produced during transform option parsing.
Functions§
- apply
- Apply all configured transformations to one captured packet.
- parse_
ip_ mapping - Parse
"OLD_IP=NEW_IP"into anIpMapping.