Sample Parser

//=================================================================
//  MODULE: ethernet.c
//
//  Description:
//
//  Network Monitor parer DLL for 802.3 (ETHERNET).
//
//  Modification History
//
//=================================================================

#include "mac.h"

//=================================================================
//  FUNCTION: RecognizeEthernetFrame()
//
//  Modification History
//
//=================================================================

LPBYTE BHAPI RecognizeEthernetFrame(
    HFRAME            hFrame,
    LPETHERNET        Frame,
    WORD              MacType,
    WORD              BytesLeft,
    LPRECOGNIZEDATA   lpRecognizeData,  // RecognizeData to fill in
    LPBYTE            lpEntriesAdded    // Increment by number of 
                                        // entries added to 
                                        // PropertyInstTable
)
{
    //=========================================================
    //  To verify that this frame is ethernet, we do the following:
    //
    //  1)  Make sure the MacType is MAC_TYPE_ETHERNET.
    //
    //  2)  Make sure the value of BytesLeft does not exceed the
    //      maximum ethernet frame size of 1514.
    //=========================================================

    if ( MacType == MAC_TYPE_ETHERNET && BytesLeft <= 
                            ETHERNET_FRAME_LENGTH )
    {
        lpRecognizeData->hPropertyDB = hDatabase;
        lpRecognizeData->nProtocolOffset = (WORD)(Frame-Frame);
        (*lpEntriesAdded)++;
        return (LPBYTE) Frame->Info;
    }

    return (LPBYTE) Frame;             //...It's not ethernet!
}

//=============================================================
//  FUNCTION: AttachProperties()
//
//  Modification History
//
//=============================================================

LPBYTE BHAPI AttachEthernetProperties(HFRAME     hFrame,
                                      LPETHERNET Frame,
                                      WORD       MacType,
                                      WORD       BytesLeft)
{
    WORD EthernetTypeField, PropIndex, FrameLength;

    //============================================================
    //  Attach the summary, addresses, and frame length fields.
    //============================================================

    AttachPropertyInstance(hFrame,
                           pit[ETHERNET_SUMMARY].hProperty,
                           sizeof(ETHERNET), Frame,
                           0,0,0);

    AttachPropertyInstance(hFrame,
                           pit[ETHERNET_DST_ADDR].hProperty,
                           sizeof Frame->DstAddr, &Frame->DstAddr,
                           0,1,0);

    AttachPropertyInstance(hFrame,
                           pit[ETHERNET_SRC_ADDR].hProperty,
                           sizeof Frame->SrcAddr, &Frame->SrcAddr,
                           0,1,0);

    FrameLength = (WORD) GetFrameLength(hFrame);

    AttachPropertyInstanceEx(hFrame,
                             pit[ETHERNET_LENGTH].hProperty,
                             0,
                             NULL,
                             sizeof(WORD),
                             &FrameLength,
                             0,1,0);

    //============================================================
    //  Attach the length/type properties.
    //============================================================

    EthernetTypeField = XCHG(Frame->Type);

    PropIndex = ((EthernetTypeField <= ETHERNET_DATA_LENGTH) ? 
                 ETHERNET_DATALENGTH : ETHERNET_TYPE);

    AttachPropertyInstanceEx(hFrame,
                             pit[PropIndex].hProperty,
                             sizeof Frame->Type,
                             &Frame->Type,
                             sizeof EthernetTypeField,
                             &EthernetTypeField,
                             0,1,0);

    return (LPBYTE) Frame->Info;
}

//===============================================================
//  FUNCTION: FormatType()
//===============================================================

VOID BHAPI FormatType(LPPROPERTYINST lpPropertyInst, HFRAME hFrame)
{
    register WORD  Etype = lpPropertyInst->lpPropertyInstEx->Word[0];
    register DWORD Length, i;

    //============================================================
    //  Format the "ETYPE = 0x600"
    //============================================================

    Length = wsprintf(lpPropertyInst->szPropertyText, "%s : 0x%.4X",
                      lpPropertyInst->lpPropertyInfo->Label, Etype, Etype);

    //=========================================================
    //  Now search for the etype in the Etype table and display
    //  the label if found.
    //=========================================================

    for(i = 0; i < EtypeSetSize; ++i)
    {
        if ( Etypes[i].Value == Etype )
        {
            Length = wsprintf(&lpPropertyInst->szPropertyText[Length], 
                              " (%s)", Etypes[i].Label);

            return;
        }
    }
}

//====================================================
//  FUNCTION: FormatDataLength()
//
//  Modification History
//
//====================================================

VOID BHAPI FormatDataLength(LPPROPERTYINST lpPropertyInst, HFRAME hFrame)
{
    wsprintf(lpPropertyInst->szPropertyText,
             "%s : 0x%.4X (%u)",
             lpPropertyInst->lpPropertyInfo->Label,
             lpPropertyInst->lpPropertyInstEx->Word[0],
             lpPropertyInst->lpPropertyInstEx->Word[0]);



}