Instead of using the slightly awkward raw expressions, header fields can be defined such that they can be accessed by name, without the need to calculate offsets, etc., each time.
Fields in a packet are declared using the field construct, which consists of the keyword field, the field name (which must not be the same as any other keyword of the tcng language), an equal sign, an expression, and optionally a precondition consisting of the keyword if followed by a Boolean expression.
If a precondition is specified, the field and all fields derived from it only exist if the precondition is true. Note that field == value and field != value are always false if the preconditions of the field are not met !
If a field expression consists only of a field, an index, and possibly a size qualifier, this expression can in turn be used as the basis for an index operation.
Examples:
field ip = raw; field ip_hl = ip[0] & 0xf; field ip_nexthdr = ip[ip_hl << 2]; field tcp = ip_nexthdr if ip_proto == IPPROTO_TCP; field tcp_SYN = (tcp_hdr[13].b >> 1) & 1;
Several fields commonly used with IPv4 are defined in ./tcng/lib/tcng/include/fields.tc (when using a local copy of tcng) or /usr/lib/tcng/include/fields.tc (when tcng is installed system-wide), see section 2.13.1.