A deep packet inspection engine for C.

#include "mmt_core.h"

int on_packet(const ipacket_t *ipacket, void *args) {
    uint32_t *src  = get_attribute_extracted_data_by_name(ipacket, "ip",   "src");
    uint32_t *dst  = get_attribute_extracted_data_by_name(ipacket, "ip",   "dst");
    uint16_t *port = get_attribute_extracted_data_by_name(ipacket, "tcp",  "dest_port");
    mmt_header_line_t *host = get_attribute_extracted_data_by_name(ipacket, "http", "host");

    if (src && dst && port) {
        uint8_t *s = (uint8_t*)src, *d = (uint8_t*)dst;   // IP = 4 octets, net order
        // host is an mmt_header_line_t (ptr + len) — not a null-terminated string.
        printf("%u.%u.%u.%u → %u.%u.%u.%u:%u  %.*s\n",
               s[0],s[1],s[2],s[3], d[0],d[1],d[2],d[3], *port,
               host ? (int)host->len : 1, host ? host->ptr : "-");
    }
    return 0;
}

int main(void) {
    init_extraction();
    char errbuf[1024];
    mmt_handler_t *h = mmt_init_handler(DLT_EN10MB, 0, errbuf);

    // Register the fields you care about — by (protocol, attribute) name.
    register_extraction_attribute_by_name(h, "ip",   "src");
    register_extraction_attribute_by_name(h, "ip",   "dst");
    register_extraction_attribute_by_name(h, "tcp",  "dest_port");
    register_extraction_attribute_by_name(h, "http", "host");
    register_packet_handler(h, 1, on_packet, NULL);

    // ... same pcap / packet_process() loop as Tier 1 ...
}

#include <pcap.h>
#include <inttypes.h>   // PRIu64
#include "mmt_core.h"

// Called periodically per active session — read flow-level stats.
void on_session(const mmt_session_t *s, void *args) {
    printf("session %"PRIu64": %"PRIu64" pkts, %"PRIu64" bytes\n",
           get_session_id(s),
           get_session_packet_count(s),
           get_session_byte_count(s));
}

// pcap delivers each frame straight into MMT.
void on_capture(u_char *user, const struct pcap_pkthdr *ph, const u_char *data) {
    mmt_handler_t *h = (mmt_handler_t*)user;
    struct pkthdr hdr = { .ts = ph->ts, .caplen = ph->caplen, .len = ph->len };
    packet_process(h, &hdr, data);
}

int main(int argc, char **argv) {
    init_extraction();
    char errbuf[1024];
    mmt_handler_t *h = mmt_init_handler(DLT_EN10MB, 0, errbuf);

    // Report each session on a timer (0 = include incomplete packets).
    register_session_timer_handler(h, on_session, NULL, 0);

    // Capture live from an interface and pump frames into MMT.
    pcap_t *pcap = pcap_open_live(argv[1], 65535, 1, 1000, errbuf);
    pcap_loop(pcap, -1, on_capture, (u_char*)h);
}