4.3 - Scanner Internals

JScanner class is the front end to a small library of functionality implemented native code (C/C++ language). The scanner can be invoked from both native code and from java space. For example the PcapPacketHandler.nextPacket method, before it is invoked by native libpcap dispatcher, it first invokes the scanner before transferring control to user's java handler. At the same time, a newly created packet using JMemoryPacket can invoke the scanner from java space using JMemoryPacket.scan which will invoke the default packet scanner for the currently active thread.

The scanner performs several functions:

• discovery of main headers in the packet
• discovery of the next header in the chain of headers using direct binding method
• invokes a java bind method
• invokes a java headerLength method defined in a header
• dissects the contents of a header. Actually maintains 2 separate tables, one for dissecting sub-headers and the second for dissecting optional fields.