Rafal Wojtczuk wrote:
>
> Hello,
> Is it possible (and safe) for a libpcap programmer to assume the
> following:
> (*) An application receives (from libpcap) packets aligned so that the
> link header ends on a 4-byte (or larger) boundary. Thus higher level
> headers, say IP header, will be aligned and conviniently accessible on
> platforms which disallow unaligned access.
Take a look at FDDI link headers. I think you will find the answer is
generally no.
> If (*) statement is true, we may use this coding (very common IMHO,
> forget the error checking :)) :
> u_char * packet = pcap_next(pcap_desc,&p_head);
> struct ip * iph=(struct ip*)(packet + link_layer_length);
> u_32 src=iph->ip_src.s_addr;
> If (*) statement does not hold, the third assignment is likely to produce
> a bus error.
>
> From my experience, (*) statement is true on sparc; how about other
> platforms ? On the other hand, Linux running on alpha did not follow this
> rule (can it be classified as a bug and fixed ?)
--
Jefferson Ogata <[EMAIL PROTECTED]>
NOAA Computer Incident Response Team (N-CIRT) <[EMAIL PROTECTED]>
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
