On Wed, 28 Sep 2016 16:43:38 +0200 Daniel Borkmann <dan...@iogearbox.net> wrote: > > (1) suppose upon entry we have > > > > DA,SA,0x8100,TCI,0x0800, > > ^ ^ > > mac_hdr data > > > > initial offset is 18, and after current unwinding code we'll get > > You mean data points after the 0x0800, right?
Sorry. Yes, exactly as you say. Initially 18 bytes ahead: DA,SA,0x8100,TCI,0x0800, ^ ^ mac_hdr data