PATTERNMATCH structure

The PATTERNMATCH structure defines pattern elements used to evaluate a frame.

Syntax

typedef struct _PATTERNMATCH {
  DWORD        Flags;
  BYTE         OffsetBasis;
  GENERIC_PORT Port;
  WORD         Offset;
  WORD         Length;
  BYTE         PatternToMatch[MAX_PATTERN_LENGTH];
} PATTERNMATCH, *LPPATTERNMATCH;

Members

Flags

Pattern match flags:

Value	Meaning
PATTERN_MATCH_FLAGS_NOT 0x00000001	When set, this flag retains frames that lack the specified pattern in the proper spot.
PATTERN_MATCH_FLAGS_PORT_SPECIFIED 0x00000008	Seeks a port number value.

OffsetBasis

Types of offset, which can be one of the following:

Value	Meaning
OFFSET_BASIS_RELATIVE_TO_FRAME	Sets an offset, in bytes, relative to start of the frame.
OFFSET_BASIS_RELATIVE_TO_EFFECTIVE_PROTOCOL	Sets an offset, in bytes, relative to the start of the referenced protocol.
OFFSET_BASIS_RELATIVE_TO_IPX	Sets an offset, in bytes, only relative to IPX.
OFFSET_BASIS_RELATIVE_TO_IP	Sets an offset, in bytes, only relative to IP.

Port

Port value, if specified.

Offset

The offset, in bytes, relative to the OffsetBasis.

Length

Length of the matched pattern.

PatternToMatch

Pattern to match.

Remarks

This structure is used to construct a capture filter. For more information about implementing this structure, see Capture Filters.

A capture filter can contain up to four PATTERNMATCH structures.

Requirements

See also

CAPTUREFILTER