Hello,
Is it possible (and safe) for a libpcap programmer to assume the
following:
(*) An application receives (from libpcap) packets aligned so that the
link header ends on a 4-byte (or larger) boundary. Thus higher level
headers, say IP header, will be aligned and conviniently accessible on
platforms which disallow unaligned access.
If (*) statement is true, we may use this coding (very common IMHO,
forget the error checking :)) :
u_char * packet = pcap_next(pcap_desc,&p_head);
struct ip * iph=(struct ip*)(packet + link_layer_length);
u_32 src=iph->ip_src.s_addr;
If (*) statement does not hold, the third assignment is likely to produce
a bus error.
>From my experience, (*) statement is true on sparc; how about other
platforms ? On the other hand, Linux running on alpha did not follow this
rule (can it be classified as a bug and fixed ?)
Save yourself,
Nergal
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
