Re: I want to add IP at first of name of decoded files
It is "simple", you can customize the dispatcher
If you use XI (and so DeMa) the dispatcher is "lite":
- cfg file: DISPATCH=disp_lite.so LOG=FEWITDS
- source code: dispatch/lite/lite.c
If you use Xplico in cli the dispatcher is "none":
- cfg file: DISPATCH=disp_none.so LOG=FEWITDS
- source code: dispatch/none/
If you use "none" then it is hard modify it, because it is empty
. In the Wiki we will describe how to do it.
But if you use "lite" then for any protocol exist a function named DispProtocol
. Inside this functions there is the call of "rename" function (es: rename(path, rep); ) . You can modify the name (rep) of the file in this place.
To find the IP in every DispProtocol
there is a variable "ip" (type val) and with function FTString you can convert the "ip" in string format:
---> FTString(&ip, FT_IPv4, ip_string_buffer);
I suppose that IP is IPv4.
For the Port it is similar to IP, but first you must know what it means "Pkt info" in Xplico ( ./xplico -i tcp ) .
In the wiki in the coming weeks there will be information on the modules dispatcher.
... have a little patience.