try negative

Author: lakshk98

pkg/plugin/ebpfwindows/ebpf_windows_test.go

@@ -813,7 +813,7 @@ func TestHandleTraceEventWithEthPacket_PktmonDropNotify(t *testing.T) {
 	// version 1
 	pdn[2] = 0x01
 	pdn[3] = 0x00
-	// PacketType 1
+	// PacketType 1 (PktMonPayloadEthernet)
 	pdn[31] = 0x01
 	pdn[32] = 0x00
 
@@ -859,7 +859,7 @@ func TestHandleTraceEventWithIpPacket_PktmonDropNotify(t *testing.T) {
 				t.Errorf("expected event type %v, got %v", MessageTypePktmonDrop, eventType)
 			}
 
-			var testDropReason int32 = 2
+			var testDropReason int32 = -2147483641
 			eventSubType := fl.GetEventType().GetSubType()
 			if eventSubType != testDropReason {
 				t.Errorf("expected event type %v, got %v", testDropReason, eventSubType)
@@ -901,12 +901,12 @@ func TestHandleTraceEventWithIpPacket_PktmonDropNotify(t *testing.T) {
 	// version 1
 	pdn[2] = 0x01
 	pdn[3] = 0x00
-	// PacketType 3
+	// PacketType 3 (PktMonPayloadIP)
 	pdn[31] = 0x03
 	pdn[32] = 0x00
 
 	// DropReason 0x00000002
-	pdn[39] = 0x02
+	pdn[39] = 0x07
 	pdn[40] = 0x00
 	pdn[41] = 0x00
 	pdn[42] = 0x00

pkg/plugin/ebpfwindows/parser_windows.go

@@ -27,7 +27,24 @@ import (
 
 const MaxInt = int(^uint(0) >> 1)
 const MessageTypePktmonDrop = 100
-const maxCapLength uint16 = 128
+
+type PktmonPacketType uint8
+
+// pktmon packet types
+const (
+	PktMonPayloadUnknown PktmonPacketType = iota
+	PktMonPayloadEthernet
+	PktMonPayloadWiFi
+	PktMonPayloadIP
+	PktMonPayloadHTTP
+	PktMonPayloadTCP
+	PktMonPayloadUDP
+	PktMonPayloadARP
+	PktMonPayloadICMP
+	PktMonPayloadESP
+	PktMonPayloadAH
+	PktMonPayloadL4Payload
+)
 
 // Parser is a parser for L3/L4 payloads
 type Parser struct {
@@ -205,7 +222,7 @@ func (p *Parser) decode(data []byte, decoded *pb.Flow) error {
 		// Fill relevant fields for dropNotify from pktmonNotify struct
 		dn = &DropNotify{}
 
-		eventSubType = pdn.PktmonHeader.Metadata.DropReason
+		eventSubType = pdn.PktmonHeader.Metadata.DropReason | (1 << 31)
 		if offset > uint(MaxInt) {
 			return fmt.Errorf("%w: %d", errDataOffsetTooLarge, offset)
 		}
@@ -230,9 +247,9 @@ func (p *Parser) decode(data []byte, decoded *pb.Flow) error {
 		var err error
 		if pdn != nil {
 			switch pdn.PktmonHeader.Metadata.PacketType {
-			case 1:
+			case uint16(PktMonPayloadEthernet):
 				err = p.packet.decLayerL2Dev.DecodeLayers(data[packetOffset:], &p.packet.Layers)
-			case 3:
+			case uint16(PktMonPayloadIP):
 				switch data[packetOffset] >> 4 {
 				case 0x4:
 					err = p.packet.decLayerL3Dev.IPv4.DecodeLayers(data[packetOffset:], &p.packet.Layers)