On 13/05/11 12:52 AM, Darren Reed wrote:
On 12/05/11 04:27 AM, Guy Harris wrote:
On May 10, 2011, at 1:40 PM, Darren Reed wrote:
To pursue this a little further, experimenting has
determined that the best layout thus far would be
something similar to this:
bits field
00-07 version (1)
08-15
On 13/05/11 01:02 AM, Guy Harris wrote:
On May 13, 2011, at 12:52 AM, Darren Reed wrote:
The goal of this is quite specific: to allow packets on a network device
to have mixed link-layer headers present and be able to use tcpdump and
friends to push meaningful filters into the kernel. The g
On May 13, 2011, at 12:52 AM, Darren Reed wrote:
> The goal of this is quite specific: to allow packets on a network device
> to have mixed link-layer headers present and be able to use tcpdump and
> friends to push meaningful filters into the kernel. The general thrust
> of that is towards IP, t
On 12/05/11 04:27 AM, Guy Harris wrote:
On May 10, 2011, at 1:40 PM, Darren Reed wrote:
To pursue this a little further, experimenting has
determined that the best layout thus far would be
something similar to this:
bits field
00-07 version (1)
08-15 pad (0)
16-31 pre-mac payload length
32-63
On May 10, 2011, at 1:40 PM, Darren Reed wrote:
> To pursue this a little further, experimenting has
> determined that the best layout thus far would be
> something similar to this:
>
> bits field
> 00-07 version (1)
> 08-15 pad (0)
> 16-31 pre-mac payload length
> 32-63 dlt (DLT_*)
> 64-79 eth
To follow this on, looking at the output of "tcpdump -d",
it became obvious that the opcodes could be optimised.
The optimised would need to be seriously smarter than
it currently is to detect that it has a repeating group of
six statements, of which the second can be eliminated.
That's completely
To pursue this a little further, experimenting has
determined that the best layout thus far would be
something similar to this:
bits field
00-07 version (1)
08-15 pad (0)
16-31 pre-mac payload length
32-63 dlt (DLT_*)
64-79 ethernet protocol number
80-95 pad (0)
The pads are to ensure that fiel
