views:

178

answers:

3

Code snippet from here:

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    ....
    /* retireve the position of the ip header */
    ih = (ip_header *) (pkt_data +
        14); //length of ethernet header
    ....

But this image doesn't say it's necessarily 14:

alt text

How should I do it properly?

+5  A: 

In 802.3, both the source and destination addresses are 48-bit MAC addresses. 6+6+2=14

Ignacio Vazquez-Abrams
Can you elaborate? Shouldn't it be 7+1+6+6+2=22?
httpinterpret
No, because those 8 bytes occur before the frame, not as part of it.
Ignacio Vazquez-Abrams
OK.But it says 2 **or** 6,so it may be 2+2+2=6 or 6+6+2=14,right?
httpinterpret
Not for 802.3. And Ethernet is 802.3.
Ignacio Vazquez-Abrams
Does it hold for both IPv6 and IPv4?
httpinterpret
TCP/IP is at a higher layer than 802.3.
Ignacio Vazquez-Abrams
Can you also elaborate how is value of `const struct pcap_pkthdr *header` populated?
httpinterpret
Not a clue. But that sounds like it warrants a separate question.
Ignacio Vazquez-Abrams
Sure, here we go:) http://stackoverflow.com/questions/2797089/whats-pcap-pkthdr-there-for
httpinterpret
A: 

The Wikipedia has a good picture of the frame

WIKI

IPv4 / v6 are layer 3 protocols.

dbasnett
A: 

The ethernet header is fixed width however extension protocols such as 802.1q for vlan/qos are common and effectivly extend the L2 header.

Einstein