Plugin programming cheatsheet

T2_PLUGIN_INIT("yourPluginName", "0.9.1", 0, 9);

T2_PLUGIN_INIT_WITH_DEPS("pluginName", "0.9.1", 0, 9, "tcpFlags");

T2_PLUGIN_INIT_WITH_DEPS("pluginName", "0.9.1", 0, 9, "tcpFlags,tcpStates");

void t2Init() {
    // allocate struct for all flows, initialize to 0 and check for errors
    T2_PLUGIN_STRUCT_NEW(pluginNameFlows);
}

binary_value_t* t2PrintHeader() {
    binary_value_t *bv = NULL;
    // Describe your output fields with the BV_APPEND macros detailed in the next section, e.g.:
    BV_APPEND_H8(bv, "mypluginStat" , "description...");
    BV_APPEND_U64(bv, "mypluginCnt" , "description...");
    return bv;
}

void t2OnNewFlow(packet_t *packet, unsigned long flowIndex) {
    // Reset the structure for this flow
    T2_PLUGIN_STRUCT_RESET_ITEM(pluginNameFlows, flowIndex);
    //pluginNameFlow_t * const pnFlowP = &pluginNameFlows[flowIndex];
    //memset(pnFlowP, '\0', sizeof(*pnFlowP));
}

void t2OnLayer2(packet_t *packet, unsigned long flowIndex) {
    if (flowIndex == HASHTABLE_ENTRY_NOT_FOUND) return;
    // This packet does not have a layer 4.
}

void t2OnLayer4(packet_t *packet, unsigned long flowIndex)

void t2OnFlowTerminate(unsigned long flowIndex, outputBuffer_t *buf) {
    pluginNameFlow_t * const pnFlowP = &pluginNameFlows[flowIndex];
    OUTBUF_APPEND_U8(buf, pnFlowP->mypluginStat);
    OUTBUF_APPEND_U64(buf, pnFlowP->mypluginCnt);
}

void t2Finalize() {
    free(pluginNameFlows);
}

static uint8_t mypluginStat;
static uint64_t mypluginCnt;

void t2PluginReport(FILE *stream) {
    if (!mypluginCnt) return;
    T2_FPLOG_NUMP0(stream, plugin_name, "Number of myplugin packets", mypluginCnt);
    T2_FPLOG_AGGR_HEX(stream, plugin_name, mypluginStat);
    // => T2_FPLOG(stream, plugin_name, "Aggregated mypluginStat=0x%02" B2T_PRIX8, mypluginStat);
}

static uint8_t mypluginStat;
static uint64_t mypluginCnt, mypluginCnt0;

void t2Monitoring(FILE *stream, uint8_t state) {
    switch (state) {

        case T2_MON_PRI_HDR:  // Print the name of the variables that will be output
            fputs("mypluginStat\tmypluginCnt\t", stream); // Note the trailing tab (\t)
            return;

        case T2_MON_PRI_VAL:  // Print the variables to monitor
            fprintf(stream, "%" PRIu64 "\t0x%02" B2T_PRIX8 "\t", // Note the trailing tab (\t)
                  mypluginCnt - mypluginCnt0, mypluginStat);
            break;

        case T2_MON_PRI_REPORT:  // print a report similar to t2PluginReport()
            T2_FPLOG_DIFFNUMP(stream, plugin_name, "Number of myplugin packets", mypluginCnt);
            T2_FPLOG_AGGR_HEX(stream, plugin_name, mypluginStat);
            // => T2_FPLOG(stream, plugin_name, "Aggregated mypluginStat=0x%02" B2T_PRIX8, mypluginStat);
            break;

        default:  // Invalid state, do nothing
            return;
    }

#if DIFF_REPORT == 1
    mypluginCnt0 = mypluginCnt;
#endif
}

static uint8_t mypluginStat;
static uint64_t mypluginCnt;

void t2SaveState(FILE *stream)
    fprintf(stream, "0x%02" PRIx8 "\t%" PRIu64, mypluginStat, mypluginCnt);
}

static uint8_t mypluginStat;
static uint64_t mypluginCnt;

void t2RestoreState(const char *str)
    sscanf(str, "0x%02" SCNx8 "\t%" SCNu64, &mypluginStat, &mypluginCnt);
}

void t2BufferToSink(outputBuffer_t *buf, binary_value_t *bv)

static const char * const plugin_name = "pluginName";

const uint16_t ethType = L2_PROTO(packet);
//const uint16_t ethType = packet->ethType;

const ethernetHeader_t * const ethHdrP = ETH_HEADER(packet);
//const ethernetHeader_t * const ethHdrP = (ethernetHeader_t*) packet->l2HdrP;

const lapdHdr_t * const lapdHdrP = LAPD_HEADER(packet);
//const lapdHdr_t * const lapdHdrP = (ethernetHeader_t*) packet->l2HdrP;

const uint8_t * const l2HdrP = L2_HEADER(packet);
//const uint8_t * const l2HdrP = packet->l2HdrP;

if (PACKET_IS_IPV6(packet)) {
    const ip6Header_t * const ip6HdrP = IPV6_HEADER(packet);             // IPv6
    //const ip6Header_t * const ip6HdrP = (ip6Header_t*) packet->l3HdrP;   // IPv6
} else if (PACKET_IS_IPV4(packet)) {
    const ipHeader_t * const ipHdrP = IPV4_HEADER(packet);               // IPv4
    //const ipHeader_t * const ipHdrP = (ipHeader_t*) packet->l3HdrP;      // IPv4
} else {
    const uint8_t * const l3HdrP = L3_HEADER(packet);
    //const uint8_t * const l3HdrP = packet->l3HdrP;
}

switch (L4_PROTO(packet)) {
//switch (packet->l4Proto) {
    case L3_TCP: {
        const tcpHeader_t * const tcpHdrP = TCP_HEADER(packet);
        //const tcpHeader_t * const tcpHdrP = (tcpHeader_t*) packet->l4HdrP;
        break;
    }
    case L3_UDP: {
        const udpHeader_t * const udpHdrP = UDP_HEADER(packet);
        //const udpHeader_t * const udpHdrP = (udpHeader_t*) packet->l4HdrP;
        break;
    }
    case L3_ICMP: {
        const icmpHeader_t * const icmpHdrP = ICMP_HEADER(packet);
        //const icmpHeader_t * const icmpHdrP = (icmpHeader_t*) packet->l4HdrP;
        break;
    }
    case L3_SCTP: {
        const sctpHeader_t * const sctpHdrP = SCTP_HEADER(packet);
        //const sctpHeader_t * const sctpHdrP = (sctpHeader_t*) packet->l4HdrP;
        break;
    }
    case L3_PIM: {
        const pimHeader_t * const pimHdrP = PIM_HEADER(packet);
        //const pimHeader_t * const pimHdrP = (pimHeader_t*) packet->l4HdrP;
        break;
    }
    default: {
        const uint8_t * const l4HdrP = L4_HEADER(packet);
        //const uint8_t * const l4HdrP = packet->l4HdrP;
        break;
    }
}

const myProto_t * const myProtoHdrP = (myProto_t*) L7_HEADER(packet);
//const myProto_t * const myProtoHdrP = (myProto_t*) packet->l7HdrP;

const uint16_t srcPort = flowP->srcPort;
const uint16_t dstPort = flowP->dstPort;

// Flow index
const uint64_t flowInd = flowP->findex;

// Flow direction
const char * const dir_s = FLOW_DIR_S(flowP);  // "A" or "B"
const char dir_c = FLOW_DIR_C(flowP);          // 'A' or 'B'

// Flow direction (alternative)
char *dir_s;
char dir_c;
if (FLOW_IS_B(flowP)) {
    dir_s = FLOW_DIR_S_B;
    dir_c = FLOW_DIR_C_B;
} else {  // FLOW_IS_A(flowP))
    dir_s = FLOW_DIR_S_A;
    dir_c = FLOW_DIR_C_A;
}

// Filename example
char filename[FILENAME_MAX] = {};
snprintf(filename, sizeof(filename), "/tmp/prefix_%" PRIu64 "_%c.bin", flowInd, dir_c);  // direction as char
snprintf(filename, sizeof(filename), "/tmp/prefix_%" PRIu64 "_%s.bin", flowInd, dir_s);  // direction as string

// Single values, e.g., 0x01

BV_APPEND_H8( bv, "myHex8Field" , "description...");
BV_APPEND_H16(bv, "myHex16Field", "description...");
BV_APPEND_H32(bv, "myHex32Field", "description...");
BV_APPEND_H64(bv, "myHex64Field", "description...");

// Repetitive values, e.g., 0x01;0x02

BV_APPEND_H8_R( bv, "myHex8Field" , "description...");
BV_APPEND_H16_R(bv, "myHex16Field", "description...");
BV_APPEND_H32_R(bv, "myHex32Field", "description...");
BV_APPEND_H64_R(bv, "myHex64Field", "description...");

// Single values, e.g., -1

BV_APPEND_I8( bv, "myInt8Field" , "description...");
BV_APPEND_I16(bv, "myInt16Field", "description...");
BV_APPEND_I32(bv, "myInt32Field", "description...");
BV_APPEND_I64(bv, "myInt64Field", "description...");

// Repetitive values, e.g., -1;-2

BV_APPEND_I8_R( bv, "myInt8Field" , "description...");
BV_APPEND_I16_R(bv, "myInt16Field", "description...");
BV_APPEND_I32_R(bv, "myInt32Field", "description...");
BV_APPEND_I64_R(bv, "myInt64Field", "description...");

// Single values, e.g., 1

BV_APPEND_U8( bv, "myInt8Field" , "description...");
BV_APPEND_U16(bv, "myInt16Field", "description...");
BV_APPEND_U32(bv, "myInt32Field", "description...");
BV_APPEND_U64(bv, "myInt64Field", "description...");

// Repetitive values, e.g., 1;2

BV_APPEND_U8_R( bv, "myInt8Field" , "description...");
BV_APPEND_U16_R(bv, "myInt16Field", "description...");
BV_APPEND_U32_R(bv, "myInt32Field", "description...");
BV_APPEND_U64_R(bv, "myInt64Field", "description...");

// Single values, e.g., 1.1

BV_APPEND_FLT(bv, "myFloatField" , "description...");
BV_APPEND_DBL(bv, "myDoubleField", "description...");

// Repetitive values, e.g., 1.1;2.2

BV_APPEND_FLT_R(bv, "myFloatField" , "description...");
BV_APPEND_DBL_R(bv, "myDoubleField", "description...");

// Single values, e.g., 00:11:22:33:44:55

BV_APPEND_MAC(bv, "myMACField" , "description...");

// Repetitive values, e.g., 00:11:22:33:44:55;01:23:45:67:89:01

BV_APPEND_MAC_R(bv, "myMACField" , "description...");

// Single values, e.g., 1.2.3.4

BV_APPEND_IP4(bv, "myIPv4Field" , "description...");
BV_APPEND_IP6(bv, "myIPv6Field" , "description...");
BV_APPEND_IPX(bv, "myIPvXField" , "description...");

// Repetitive values, e.g., 1.2.3.4;2.3.4.5

BV_APPEND_IP4_R(bv, "myIPv4Field" , "description...");
BV_APPEND_IP6_R(bv, "myIPv6Field" , "description...");
BV_APPEND_IPX_R(bv, "myIPvXField" , "description...");

// Single values, e.g., 0.1

BV_APPEND_TIMESTAMP(bv, "myTimestampField", "description...");
BV_APPEND_DURATION( bv, "myDurationField" , "description...");

// Repetitive values, e.g., 0.1;0.2

BV_APPEND_TIMESTAMP_R(bv, "myTimestampField", "description...");
BV_APPEND_DURATION_R( bv, "myDurationField" , "description...");

// Single values, e.g., "string1"

BV_APPEND_CHAR(bv, "myCharField"       , "description...");
BV_APPEND_STR( bv, "myStringField"     , "description...");
BV_APPEND_STRC(bv, "myStringClassField", "description...");

// Repetitive values, e.g., "string1";"string2"

BV_APPEND_CHAR_R(bv, "myCharField"       , "description...");
BV_APPEND_STR_R( bv, "myStringField"     , "description...");
BV_APPEND_STRC_R(bv, "myStringClassField", "description...");

#if VAL_UINT8 == 1
binary_type_t myType = bt_hex_8;
#else // VAL_UINT8 == 0
binary_type_t myType = bt_hex_16;
#endif // VAL_UINT8 == 0

// Single values, e.g., val1

BV_APPEND_TYPE(bv, "myField", "description...", myType);

// Repetitive values, e.g., val1;val2

BV_APPEND_TYPE_R(bv, "myField", "description...", myType);

// Single values, e.g., 1_2

BV_APPEND(bv, "myCompoundPart1_Part2", "description...", number_of_fields, type1, type2, ...);
BV_APPEND(bv, "myCompoundPart1_Part2", "description...", number_of_fields, type1, type2, ...);

// Repetitive values, e.g., 1_2;3_4

BV_APPEND_R(bv, "myCompoundPart1_Part2", "description...", number_of_fields, type1, type2, ...);
BV_APPEND_R(bv, "myCompoundPart1_Part2", "description...", number_of_fields, type1, type2, ...);

uint8_t val8 = 0;
OUTBUF_APPEND_U8(buf, val8);

uint16_t val16 = 0;
OUTBUF_APPEND_U16(buf, val16);

uint32_t val32 = 0;
OUTBUF_APPEND_U32(buf, val32);

uint64_t val64 = 0;
OUTBUF_APPEND_U64(buf, val64);

// Automatically converted from network to host order

OUTBUF_APPEND_U16_NTOH(buf, val16);
OUTBUF_APPEND_U32_NTOH(buf, val32);
OUTBUF_APPEND_U64_NTOH(buf, val64);

// Special cases: append unsigned value 0

OUTBUF_APPEND_U8_ZERO(buf);
OUTBUF_APPEND_U16_ZERO(buf);
OUTBUF_APPEND_U32_ZERO(buf);
OUTBUF_APPEND_U64_ZERO(buf);

int8_t val8 = 0;
OUTBUF_APPEND_I8(buf, val8);

int16_t val16 = 0;
OUTBUF_APPEND_I16(buf, val16);

int32_t val32 = 0;
OUTBUF_APPEND_I32(buf, val32);

int64_t val64 = 0;
OUTBUF_APPEND_I64(buf, val64);

// Special cases: append signed value 0

OUTBUF_APPEND_I8_ZERO(buf);
OUTBUF_APPEND_I16_ZERO(buf);
OUTBUF_APPEND_I32_ZERO(buf);
OUTBUF_APPEND_I64_ZERO(buf);

float valf = 0.0f;
OUTBUF_APPEND_FLT(buf, valf);

double vald = 0.0;
OUTBUF_APPEND_DBL(buf, vald);

// Special cases: append floating point value 0

OUTBUF_APPEND_FLT_ZERO(buf);
OUTBUF_APPEND_DBL_ZERO(buf);

uint8_t mac[ETH_ALEN] = { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55 };
OUTBUF_APPEND_MAC(buf, mac);

// Special case: append MAC address 00:00:00:00:00:00

OUTBUF_APPEND_MAC_ZERO(buf);

OUTBUF_APPEND_IP4(buf, ip);           // ip MUST be of type ipAddr_t or ip4Addr_t
OUTBUF_APPEND_IP6(buf, ip);           // ip MUST be of type ipAddr_t
OUTBUF_APPEND_IPV(buf, ip);           // ip MUST be of type ipVAddr_t
OUTBUF_APPEND_IPVX(buf, version, ip); // ip MUST be of type ipAddr_t or ip4Addr_t

// Alternatively:

uint32_t val32 = 0x04030201;
OUTBUF_APPEND_U32(buf, val32);        // val MUST be an IPv4 address (uint32_t) in network order

uint8_t ip6[16] = {};
OUTBUF_APPEND(buf, ip6, sizeof(ip6)); // ip6 MUST be an IPv6 address (uint8_t array of size 16) in network order

// Special cases: append IPv4 address 0.0.0.0 or IPv6 address ::

OUTBUF_APPEND_IP4_ZERO(buf);
OUTBUF_APPEND_IP6_ZERO(buf);

uint64_t sec = 0;
uint32_t usec = 0;
OUTBUF_APPEND_TIME(buf, sec, usec);

// Seconds only

OUTBUF_APPEND_TIME_SEC(buf, sec);

// Special case: append timestamp 0

OUTBUF_APPEND_TIME_ZERO(buf);

char *str = "string";
OUTBUF_APPEND_STR(buf, str);

// If there is no string to append:

OUTBUF_APPEND_STR_EMPTY(buf);
//OUTBUF_APPEND_STR(buf, "");  // Alternative

// If the string needs to be free'd:

char *str = strdup("string");
OUTBUF_APPEND_STR_AND_FREE(buf, str); // Also works if str is NULL

#if VAL_UINT8 == 1
uint8_t val = 0;
#else // VAL_UINT8 == 0
uint16_t val = 0;
#endif // VAL_UINT8 == 0
OUTBUF_APPEND(buf, val, sizeof(val));

uint32_t size = 3; // size MUST be a uint32_t variable

uint8_t array[size] = {};
OUTBUF_APPEND_ARRAY_U8(buf , array, size);

uint16_t array[size] = {};
OUTBUF_APPEND_ARRAY_U16(buf, array, size);

uint32_t array[size] = {};
OUTBUF_APPEND_ARRAY_U32(buf, array, size);

uint64_t array[size] = {};
OUTBUF_APPEND_ARRAY_U64(buf, array, size);

int8_t array[size] = {};
OUTBUF_APPEND_ARRAY_I8(buf , array, size);

int16_t array[size] = {};
OUTBUF_APPEND_ARRAY_I16(buf, array, size);

int32_t array[size] = {};
OUTBUF_APPEND_ARRAY_I32(buf, array, size);

int64_t array[size] = {};
OUTBUF_APPEND_ARRAY_I64(buf, array, size);

float array[size] = {};
OUTBUF_APPEND_ARRAY_FLT(buf, array, size);

double array[size] = {};
OUTBUF_APPEND_ARRAY_DBL(buf, array, size);

uint8_t array[size][ETH_ALEN] = {};
OUTBUF_APPEND_ARRAY_MAC(buf, array, size);

ip4Addr_t array[size] = {}; // or ipAddr_t array[size];
OUTBUF_APPEND_ARRAY_IP4(buf, array, size);

ipAddr_t array[size] = {};
OUTBUF_APPEND_ARRAY_IP6(buf, array, size);

ipVAddr_t array[size] = {};
OUTBUF_APPEND_ARRAY_IPV(buf, array, size);

ipAddr_t array[size] = {};
const uint_fast8_t version = FLOW_IPVER(flowP);
OUTBUF_APPEND_ARRAY_IPVX(buf, version, array, size);

char *array[size] = {};
OUTBUF_APPEND_ARRAY_STR(buf, array, size);

char *array[size] = {};
array[0] = strdup("string1");
array[1] = strdup("string2");
OUTBUF_APPEND_ARRAY_STR_AND_FREE(buf, array, size);

char *str = "andy";
OUTBUF_APPEND_OPT_STR(buf, str);
//=> OUTBUF_APPEND_NUMREP(buf, ONE);
//=> OUTBUF_APPEND_STR(buf, str);

char *str = "";
OUTBUF_APPEND_OPT_STR(buf, str);
//=> OUTBUF_APPEND_NUMREP(buf, ZERO);

uint32_t size = 5;
OUTBUF_APPEND_NUMREP(buf, size);
//OUTBUF_APPEND_U32(buf, size);  // Alternative
for (uint_fast32_t i = 0; i < size; i++) {
    // Append repetition 'i'
    //OUTBUF_APPEND...(buf, array[i]);
}

OUTBUF_APPEND_NUMREP_ZERO(buf);

OUTBUF_APPEND_NUMREP_ONE(buf);
OUTBUF_APPEND...(buf, ...) // append the actual value

const uint16_t snaplen = packet->snapL7Len;
const uint8_t * const l7Hdr = packet->l7HdrP;
t2buf_t t2buf = t2buf_create(l7Hdr, snaplen);

while (t2buf_left(&t2buf) > 0) { /* Read some data */ }

// Get the current position in the buffer
const long pos = t2buf_tell(&t2buf);

// Get a pointer to the current position in the buffer
uint8_t *ptr = t2buf_ptr(&t2buf);

const long offset = 5;

// Seek from the start of the buffer
if (!t2buf_seek(&t2buf, offset, SEEK_SET)) return;  // => new position = 5

// Seek from the current position in the buffer
if (!t2buf_seek(&t2buf, offset, SEEK_CUR)) return;  // => new position = pos + 5

// Seek from the end of the buffer
if (!t2buf_seek(&t2buf, -offset, SEEK_END)) return; // => new position = snaplen - 5

// Seek to the start of the buffer
if (!t2buf_rewind(&t2buf)) return;  // => new position = 0

// Seek to the start of the buffer (alternative)
if (!t2buf_seek(&t2buf, 0, SEEK_SET)) return;  // => new position = 0

uint8_t  u8;
uint16_t u16;
uint32_t u32;
uint64_t u64;

// Big endian (network order)

if (!t2buf_read_u8( &t2buf, &u8))  return;
if (!t2buf_read_u16(&t2buf, &u16)) return;
if (!t2buf_read_u24(&t2buf, &u32)) return;
if (!t2buf_read_u32(&t2buf, &u32)) return;
if (!t2buf_read_u48(&t2buf, &u64)) return;
if (!t2buf_read_u64(&t2buf, &u64)) return;

uint8_t ip[16];
if (!t2buf_read_n(&t2buf, ip, sizeof(ip))) return;

// Little endian

if (!t2buf_read_le_u8( &t2buf, &u8))  return;
if (!t2buf_read_le_u16(&t2buf, &u16)) return;
if (!t2buf_read_le_u24(&t2buf, &u32)) return;
if (!t2buf_read_le_u32(&t2buf, &u32)) return;
if (!t2buf_read_le_u48(&t2buf, &u64)) return;
if (!t2buf_read_le_u64(&t2buf, &u64)) return;

uint8_t  u8;
uint16_t u16;
uint32_t u32;
uint64_t u64;

// Big endian (network order)

if (!t2buf_peek_u8( &t2buf, &u8))  return;
if (!t2buf_peek_u16(&t2buf, &u16)) return;
if (!t2buf_peek_u24(&t2buf, &u32)) return;
if (!t2buf_peek_u32(&t2buf, &u32)) return;
if (!t2buf_peek_u48(&t2buf, &u64)) return;
if (!t2buf_peek_u64(&t2buf, &u64)) return;

// Little endian

if (!t2buf_peek_le_u16(&t2buf, &u16)) return;
if (!t2buf_peek_le_u24(&t2buf, &u32)) return;
if (!t2buf_peek_le_u32(&t2buf, &u32)) return;
if (!t2buf_peek_le_u48(&t2buf, &u64)) return;
if (!t2buf_peek_le_u64(&t2buf, &u64)) return;

const t2buf_encoding encoding = T2BUF_ASCII;
const t2buf_encoding encoding = T2BUF_ANSI;
const t2buf_encoding encoding = T2BUF_UTF8;
const t2buf_encoding encoding = T2BUF_UTF16;
const t2buf_encoding encoding = T2BUF_UTF16_LE;

#define MYDST_SIZE 5                            // includes NULL terminator
uint8_t dst[MYDST_SIZE] = {};
const bool ignore_errors = false;               // continue reading on encoding errors
                                                // (invalid characters are replaced with '.')
const long read = t2buf_readstr(&t2buf, dst, MYDST_SIZE, encoding, ignore_errors);
//const long read = t2buf_readnstr(&t2buf, dst, MYDST_SIZE, (size_t)((MYDST_SIZE-1) / 2), T2BUF_UTF16, true);
if (read == T2BUF_EMPTY) return;                // Nothing was read
else if (read == T2BUF_DST_FULL) return;        // Destination buffer was not big enough
else if (read == T2BUF_ENC_ERROR) exit(1);      // Provided encoding parameter not supported or unknown

const size_t src_bytes = 4; // Number of source bytes to read
//char hex[2 * src_bytes + 1];
//char sep = 0;   // No separator
char hex[3 * src_bytes];
char sep = ':';
const size_t read = t2buf_hexdecode(&t2buf, src_bytes, hex, sep); // 01:02:03:04
if (read != src_bytes) return; // Could not read enough bytes => snapped

#define MYLINELEN 64                     // includes NULL terminator
uint8_t line[MYLINELEN];
//bool trim = false;                     // Store the line return in line
bool trim = true;                        // Do not store the line return in line
const long read = t2buf_readline(&t2buf, line, MYLINELEN, trim);
if (read == T2BUF_EMPTY) return;         // Nothing was read
else if (read == T2BUF_DST_FULL) return; // Destination buffer was not big enough
else if (read == T2BUF_NULL) return;     // NULL character was encountered before end of line

if (!t2buf_skip_u8( &t2buf)) return;
if (!t2buf_skip_u16(&t2buf)) return;
if (!t2buf_skip_u24(&t2buf)) return;
if (!t2buf_skip_u32(&t2buf)) return;
if (!t2buf_skip_u48(&t2buf)) return;
if (!t2buf_skip_u64(&t2buf)) return;

const size_t n = 32;
if (!t2buf_skip_n(&t2buf, n)) return;

// Skip strings

const long skipped = t2buf_skipstr(&t2buf, encoding); // 'skipped' bytes were skipped
if (skipped == T2BUF_EMPTY) return;                   // Nothing was read
else if (skipped == T2BUF_ENC_ERROR) exit(1);         // Provided encoding parameter not supported or unknown

const long skipped = t2buf_skipnstr(&t2buf, skipped_max, encoding); // 'skipped' bytes were skipped (<= skipped_max)
if (skipped == T2BUF_EMPTY) return;                                 // Nothing was read
else if (skipped == T2BUF_ENC_ERROR) exit(1);                       // Provided encoding parameter not supported or unknown

// Skip entire lines

const long skipped = t2buf_skipline(&t2buf); // 'skipped' bytes were skipped
if (skipped == T2BUF_EMPTY) return;          // Nothing was skipped

const size_t skipped_max = 5;
const long skipped = t2buf_skipnline(&t2buf, skipped_max); // 'skipped' bytes were skipped (<= skipped_max)
if (skipped == T2BUF_EMPTY) return;                        // Nothing was skipped

const long len = t2buf_strlen(&t2buf, T2BUF_UTF8); // NULL character is included in 'len'

const long len = t2buf_linelen(&t2buf);  // 'len' includes terminating character(s)
if (len == T2BUF_EMPTY) return;          // Nothing was read

const void *needle = "ANTEATER";
const size_t needle_len = strlen(needle);
const bool found = t2buf_memmem(&t2buf, needle, needle_len); // search for 'needle' of 'needle_len' in the buffer
if (found) {
    // t2buf now points to the start of needle
}

typedef struct flow_s {
    // Pointers to the next and previous flow in LRU list
    struct flow_s *  lruNextFlow;
    struct flow_s *  lruPrevFlow;

    uint64_t         findex;                // flow index
    uint64_t         status;                // status of flow, e.g., fragmentation processing

    unsigned long    flowIndex;
    unsigned long    oppositeFlowIndex;

#if (SCTP_ACTIVATE > 0 && SCTP_STATFINDEX == 1)
    unsigned long    sctpFindex;
#endif // (SCTP_ACTIVATE > 0 && SCTP_STATFINDEX == 1)

    struct timeval   lastSeen;   // last time we've seen this flow
    struct timeval   firstSeen;  // first time we've seen this flow
    struct timeval   duration;   // lastSeen - firstSeen
                                 // (NOT available before flow completely terminated)

    /* --------------------------------------------------------------------- */
    /* Begin flow identification                                             */
    /* --------------------------------------------------------------------- */

#if IPV6_ACTIVATE > 0
    ipAddr_t         srcIP;
    ipAddr_t         dstIP;
#else // IPV6_ACTIVATE == 0
    ip4Addr_t        srcIP;
    ip4Addr_t        dstIP;
#endif // IPV6_ACTIVATE == 0

#if ETH_ACTIVATE > 0
    ethDS_t          ethDS;
#endif

#if (IPV6_ACTIVATE == 2 || ETH_ACTIVATE > 0 || LAPD_ACTIVATE == 1)
    uint16_t         ethType;
#endif

    uint16_t         vlanId;

    union {
        struct {
            uint16_t srcPort;
            uint16_t dstPort;
        };
        uint32_t     fragID;
    };

#if SCTP_ACTIVATE & 2
    uint32_t         sctpVtag;
#endif // SCTP_ACTIVATE & 2

#if SCTP_ACTIVATE & 1
    uint16_t         sctpStrm;
#endif // SCTP_ACTIVATE & 1

    uint8_t          l4Proto;

    /* --------------------------------------------------------------------- */
    /* End flow identification                                               */
    /* --------------------------------------------------------------------- */

    float            timeout;               // timeout of this flow in seconds

    uint32_t         lastIPID;              // for duplicate IP ID detection

#if SUBNET_INIT != 0
    uint32_t         subnetNrSrc;
    uint32_t         subnetNrDst;
#endif // SUBNET_INIT != 0

    // for fragPend hash cleanup
#if IPV6_ACTIVATE > 0
    uint32_t        lastFragIPID;
#else // IPV6_ACTIVATE == 0
    uint16_t        lastFragIPID;
#endif // IPV6_ACTIVATE == 0

} __attribute__((packed)) flow_t;

typedef struct {
#if (FDURLIMIT > 0 && FDLSFINDEX == 1)
    uint64_t findex;
#endif //(FDURLIMIT > 0 && FDLSFINDEX == 1)

    uint64_t status;

    /* --------------------------------------------------------------------- */
    /* Pointers (network order)                                              */
    /* --------------------------------------------------------------------- */

    const struct pcap_pkthdr * const pcapHdrP;

    const uint8_t * const   raw_packet;    // Beginning of the packet
    const uint8_t * const   end_packet;    // Beyond the end of the packet
                                           // (raw_packet + snapLen);

    const uint8_t *         l2HdrP;        // Layer 2 (Ethernet, LLC, LAPD, ...)
    const uint8_t *         l3HdrP;        // Layer 3 (IPv4, IPv6, ...)
    const uint8_t *         l4HdrP;        // Layer 4 (TCP, UDP, ICMP, IGMP, SCTP, ...)
    const uint8_t *         l7HdrP;        // Layer 7 (payload)

    const etherLLCHeader_t* etherLLC;      // Ethernet header LLC part if present (set but not used)
    const pppHu_t *         pppHdrP;       // PPP header
    const pppoEH_t *        pppoeHdrP;     // PPPoE header
    const uint32_t *        mplsHdrP;      // MPLS pointer
    const uint32_t *        vlanHdrP;      // VLAN pointer

    // GRE headers
    const greHeader_t *     greHdrP;       // GRE v1,2 header
    const uint8_t     *     greL3HdrP;     // L3 header before GRE header

    // GTP headers
    const uint8_t *         gtpHdrP;       // GTP v0,1,2 header (set but no used)

    // L2TP headers
    const uint16_t *        l2tpHdrP;      // L2TPv2 header
    const uint8_t  *        l2tpL3HdrP;    // L3 header before L2TP header

    // IPv6 headers
    const ip6OptHdr_t *     ip6HHOptHdrP;  // IPv6 Hop-by-Hop Option header
    const ip6OptHdr_t *     ip6DOptHdrP;   // IPv6 Destination Option header
    const ip6FragHdr_t *    ip6FragHdrP;   // IPv6 Fragment header
    const ip6RouteHdr_t *   ip6RouteHdrP;  // IPv6 Routing header (set but not used)

    // Teredo headers
    const uint8_t *         trdoOIHdrP;    // Teredo Origin Indication header
    const uint8_t *         trdoAHdrP;     // Teredo Authentication header

#if SCTP_ACTIVATE > 0
    const uint8_t *         l7SctpHdrP;    // First SCTP payload
#endif // SCTP_ACTIVATE > 0

    /* --------------------------------------------------------------------- */
    /* Lengths (host order)                                                  */
    /*   - Snap lengths can be truncated due to limited snaplength           */
    /*     (derived by header dissection)                                    */
    /* --------------------------------------------------------------------- */

    const uint32_t          rawLen;          // extracted from pcapHdrP
    uint32_t                l2Len;           // derived from IP header length field + length of L2 header (set but not used)
    uint32_t                len;             // derived from IP header length field, defined by PACKETLENGTH in packetCapture.h:
                                             //   0: Including L2-4 header,
                                             //   1: including L3-4 header,
                                             //   2: Including L4 header,
                                             //   3: Only payload L7

    // Snap lengths (can be truncated due to limited snaplength, derived by header dissection)
    const uint32_t          snapLen;         // extracted from pcapHdrP
    uint32_t                snapL2Len;       // includes L2 header
    uint32_t                snapL3Len;       // includes L3 header
    uint16_t                snapL4Len;       // includes L4 header
    uint16_t                snapL7Len;       // only higher packet payload (L7)

    uint16_t                l7Len;           // L7 length

#if SCTP_ACTIVATE > 0
    uint16_t                snapSctpL7Len;   // only higher packet payload (L7)
#endif // SCTP_ACTIVATE > 0

    uint16_t                l2HdrLen;        // set but not used
    uint16_t                l3HdrLen;
    uint16_t                l4HdrLen;

    /* --------------------------------------------------------------------- */
    /* Flow identification (IP addresses, ports and protocols (host order),  */
    /* headers count and description, ...                                    */
    /* --------------------------------------------------------------------- */

#if IPV6_ACTIVATE > 0
    ipAddr_t                srcIP;
    ipAddr_t                dstIP;
#else // IPV6_ACTIVATE == 0
    ip4Addr_t               srcIP;
    ip4Addr_t               dstIP;
#endif // IPV6_ACTIVATE == 0

#if ((SUBNET_INIT != 0) || (AGGREGATIONFLAG & (SUBNET | SRCIP | DSTIP)))
#if IPV6_ACTIVATE > 0
    ipAddr_t                srcIPC;
    ipAddr_t                dstIPC;
#else // IPV6_ACTIVATE == 0
    ip4Addr_t               srcIPC;
    ip4Addr_t               dstIPC;
#endif // IPV6_ACTIVATE == 0

    uint32_t                subnetNrSrc;
    uint32_t                subnetNrDst;
    uint16_t                srcPortC;
    uint16_t                dstPortC;
    uint8_t                 l4ProtoC;
#endif // ((SUBNET_INIT != 0) || (AGGREGATIONFLAG & (SUBNET | SRCIP | DSTIP)))

    uint16_t                vlanId;
    uint16_t                srcPort;
    uint16_t                dstPort;
    uint16_t                ethType;
    uint16_t                outerEthType;
    uint16_t                l3Proto;                    // IPv4, IPv6, L2TPv2/3, ...

    // Headers description, e.g., eth:ipv4:tcp
#if T2_PRI_HDRDESC == 1
    uint16_t                numHdrDesc;                 // Number of headers description
    uint16_t                hdrDescPos;                 // Headers description position
    char                    hdrDesc[T2_HDRDESC_LEN];    // Headers description
#endif // T2_PRI_HDRDESC == 1

    uint8_t                 l4Proto;                    // TCP, UDP, ICMP, IGMP, ...
    uint8_t                 mplsHdrCnt;
    uint8_t                 vlanHdrCnt;

#if SCTP_ACTIVATE > 0
    uint8_t                 sctpPad;                    // SCTP padding of content
#endif // SCTP_ACTIVATE > 0

} packet_t;

typedef struct {
    uint8_t ether_dhost[ETH_ALEN]; // destination eth addr
    uint8_t ether_shost[ETH_ALEN]; // source ether addr
} __attribute__((packed)) ethDS_t;

typedef union {
    uint32_t        IPv4x[4];
    struct in_addr  IPv4;       // IPv4 address
    struct in6_addr IPv6;       // IPv6 address
    uint64_t        IPv6L[2];   // IPv6 address 2*64 bit max chunk for masking ops
} __attribute__((packed)) ipAddr_t;

typedef struct {
    uint8_t  ver;    // version
    ipAddr_t addr;
} ipVAddr_t;

typedef union {
    uint32_t       IPv4x[1];
    struct in_addr IPv4;
} __attribute__((packed)) ip4Addr_t;

typedef struct {
    ethDS_t  ethDS;
    uint16_t ether_type; // packet type ID field or length
    uint16_t data;
} __attribute__((packed)) ethernetHeader_t;

#define IP_V(ip) (((ip)->ip_vhl & 0xf0) >> 4) // Version
#define IP_HL(ip) ((ip)->ip_vhl & 0x0f)       // Header length

...

typedef struct {
    uint8_t        ip_vhl;  // version, header length
    uint8_t        ip_tos;  // type of service
    uint16_t       ip_len;  // total length
    uint16_t       ip_id;   // identification
    uint16_t       ip_off;  // fragment offset field
    uint8_t        ip_ttl;  // time to live
    uint8_t        ip_p;    // protocol
    uint16_t       ip_sum;  // checksum
    struct in_addr ip_src;  // source address
    struct in_addr ip_dst;  // destination address
} __attribute__((packed)) ipHeader_t;

typedef struct {
    uint32_t    vtc_flw_lbl;  // first word: ver, tcl, flow
    uint16_t    payload_len;  // payload length
    uint8_t     next_header;  // next protocol
    union {
        uint8_t hop_limit;    // hop limit
        uint8_t ip_ttl;       // TTL
    };
    ipAddr_t    ip_src;       // source address
    ipAddr_t    ip_dst;       // destination address
} __attribute__((packed)) ip6Header_t;

typedef struct {
    uint16_t source;
    uint16_t dest;
    uint32_t seq;
    uint32_t ack_seq;
    uint8_t  res1:4;
    uint8_t  doff:4;
    uint8_t  flags;
    uint16_t window;
    uint16_t check;
    uint16_t urg_ptr;
} __attribute__((packed)) tcpHeader_t;

typedef struct {
    uint16_t source;
    uint16_t dest;
    uint16_t len;
    uint16_t check;
} __attribute__((packed)) udpHeader_t;

typedef struct {
    uint8_t  type;  // message type
    uint8_t  code;  // type sub-code
    uint16_t checksum;
    union {
        // echo datagram
        struct {
            uint16_t id;
            uint16_t sequence;
        } echo;
        // gateway address
        uint32_t gateway;
        // path mtu discovery
        struct {
            uint16_t unused;
            uint16_t mtu;
        } frag;
    };
} __attribute__((packed)) icmpHeader_t;

typedef struct {
    uint16_t source;    // Source port
    uint16_t dest;      // Destination port
    uint32_t verTag;    // Verification tag
    uint32_t chkSum;    // Checksum
    uint32_t data;
} __attribute__((packed)) sctpHeader_t;

char *msg = "text";

// Tranalyzer2 already looked up source and destination address for each packet
const uint32_t num = packet->subnetNrSrc;
//const uint32_t num = packet->subnetNrDst;
const uint_fast8_t ipver = PACKET_IPVER(packet);

// To lookup other addresses:
uint32_t netNum;
ipAddr_t ip = packet->srcIP;
SUBNET_TEST_IP(netNum, ip, ipver);
//SUBNET_TEST_IP4(netNum, ip); // for IPv4
//SUBNET_TEST_IP6(netNum, ip); // for IPv6

// Autonomous System Number
uint32_t asn;
SUBNET_ASN(asn, ipver, num);
//SUBNET4_ASN(asn, num); // for IPv4
//SUBNET6_ASN(asn, num); // for IPv6

// Country
char *country;
SUBNET_LOC(country, ipver, num);
//SUBNET4_LOC(country, num); // for IPv4
//SUBNET6_LOC(country, num); // for IPv6

// County
char *county;
SUBNET_CNTY(county, ipver, num);
//SUBNET_CNTY(county, num); // for IPv4
//SUBNET_CNTY(county, num); // for IPv6

// City
char *city;
SUBNET_CTY(city, ipver, num);
//SUBNET4_CTY(city, num); // for IPv4
//SUBNET6_CTY(city, num); // for IPv6

// Organization
char *org;
SUBNET_ORG(org, ipver, num);
//SUBNET4_ORG(org, num); // for IPv4
//SUBNET6_ORG(org, num); // for IPv6

// Hexadecimal code
uint32_t netID;
SUBNET_NETID(netID, ipver, num);
//SUBNET4_NETID(netID, num); // for IPv4
//SUBNET6_NETID(netID, num); // for IPv6

// Latitude, longitude and precision
float lat, lng, prec;
SUBNET_LAT(dest, ipver, num);     // Latitude
SUBNET_LNG(dest, ipver, num);     // Longitude
SUBNET_PREC(dest, ipver, num);    // Precision
//SUBNET4_LAT(dest, num);  // Latitude for IPv4
//SUBNET4_LNG(dest, num);  // Longitude for IPv4
//SUBNET4_PREC(dest, num)  // Precision for IPv4
//SUBNET6_LAT(dest, num);  // Latitude for IPv6
//SUBNET6_LNG(dest, num);  // Longitude for IPv6
//SUBNET6_PREC(dest, num)  // Precision for IPv6

const char * const str = "Andy was here";

if (t2_str_has_prefix(str, "Andy")) {
    // 'str' starts with 'Andy'
}

if (t2_str_has_suffix(str, "here")) {
    // 'str' ends with 'here'
}

char dest[9];
t2_strcpy(dest, str, sizeof(dest), T2_STRCPY_EXIT);     // abort if dest too small
t2_strcpy(dest, str, sizeof(dest), T2_STRCPY_EMPTY);    // dest will be empty if dest too small: dest[0] = '\0'
t2_strcpy(dest, str, sizeof(dest), T2_STRCPY_TRUNC);    // truncate string if dest too small: dest = "Andy was"
t2_strcpy(dest, str, sizeof(dest), T2_STRCPY_ELLIPSIS); // truncate and ellipsize string if dest too small: dest = "Andy ..."

const char * const andy = "Andy";
const char * const was_here = "was here";
char *andy_was_here = t2_strdup_printf("%s %s", andy, was_here);
printf("%s\n", andy_was_here); // -> Andy was here
free(andy_was_here);

void t2OnFlowTerminate(unsigned long flowIndex, outputBuffer_t *buf) {
    flow_t * const flowP = &flows[flowIndex];
    mypluginFlow_t *mypluginFlowP = &mypluginFlows[flowIndex];

#if ALARM_MODE == 1
    T2_SET_STATUS(flowP, FL_ALARM);           // Set the alarm bit in flowStat
    T2_REPORT_ALARMS(mypluginFlowP->alarms);  // Report alarm(s) to the core
#endif // ALARM_MODE == 1

    ...
}

flow_t *flowP = &flows[flowIndex];
T2_RM_FLOW(flowP);

#define MYPLUGIN_SAVE  0 // Save data
#define MYPLUGIN_RMDIR 1 // Empty MYPLUGIN_PATH before starting

#define MYPLUGIN_PATH "/tmp/myPluginData/" // Path for extracted files

#if MYPLUGIN_SAVE == 1
    T2_MKPATH(MYPLUGIN_PATH, MYPLUGIN_RMDIR);
#endif // MYPLUGIN_SAVE == 1

FILE *file = t2_fopen_in_dir(pluginFolder, "myFile.txt", "r");
if (UNLIKELY(!file)) exit(EXIT_FAILURE);

size_t len;
ssize_t read;
char *line = NULL;
while ((read = getline(&line, &len, file)) != -1) {
    if (line[0] == '#') continue; // skip comments
    if (line[read-1] == '\n') line[--read] = '\0';
    // ...
}

free(line);
fclose(file);

FILE *file = t2_fopen_with_suffix(baseFileName, "_mySuffix.txt", "w");
if (UNLIKELY(!file)) exit(EXIT_FAILURE);
fputs("Write something in the file...\n", file);
fprintf(file, "Number of %s packets: %" PRIu64 " packets\n", plugin_name, numPackets);
fclose(file);

const uint8_t * const payload = packet->l7HdrP;
const uint16_t snaplen = packet->snapL7Len;

const char *needle = "Andy";
char *andy = memmem(payload, snaplen, needle, strlen(needle));
if (andy) {
    // Andy was here
} else {
    // where is Andy? Not in the payload...
}