PATTERNMATCH
The PATTERNMATCH structure defines pattern elements used to evaluate a frame.
typedef struct _PATTERNMATCH {
DWORD Flags;
BYTE OffsetBasis;
GENERIC_PORT Port;
WORD Offset;
WORD Length;
BYTE PatternToMatch[MAX_PATTERN_LENGTH];
} PATTERNMATCH,
*LPPATTERNMATCH;
Flags
Pattern match flags:Value Meaning PATTERN_MATCH_FLAGS_NOT
0x00000001When set, this flag retains frames that lack the specified pattern in the proper spot. PATTERN_MATCH_FLAGS_PORT_SPECIFIED
0x00000008Seeks a port number value. OffsetBasis
Types of offset, which can be one of the following:Value Meaning OFFSET_BASIS_RELATIVE_TO_FRAME Sets an offset, in bytes, relative to start of the frame. OFFSET_BASIS_RELATIVE_TO_EFFECTIVE_PROTOCOL Sets an offset, in bytes, relative to the start of the referenced protocol. OFFSET_BASIS_RELATIVE_TO_IPX Sets an offset, in bytes, only relative to IPX. OFFSET_BASIS_RELATIVE_TO_IP Sets an offset, in bytes, only relative to IP. Port
Port value, if specified.Offset
The offset, in bytes, relative to the OffsetBasis.Length
Length of the matched pattern.PatternToMatch
Pattern to match.
This structure is used to construct a capture filter. For more information about implementing this structure, see Capture Filters.
A capture filter can contain up to four PATTERNMATCH structures.
Client | Requires Windows XP, Windows 2000 Professional, or Windows NT Workstation 4.0. |
Server | Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server 4.0. |
Header | Declared in Netmon.h. |