On May 23, 2011, at 9:58 AM, Rick Jones wrote: > Are there alignment differences for the different buffer sizes? For > example, when one would use 1518, would one be better-off using 1520 to > end on a 4 byte boundary and so begin on a 4 byte boundary if these > buffers are carved one after the other?
To quote the Linux packet_mmap.txt file: > If you check the source code you will see that what I draw here as a frame > is not only the link level frame. At the beginning of each frame there is a > header called struct tpacket_hdr used in PACKET_MMAP to hold link level's > frame > meta information like timestamp. So what we draw here a frame it's really > the following (from include/linux/if_packet.h): > > /* > Frame structure: > > - Start. Frame must be aligned to TPACKET_ALIGNMENT=16 > - struct tpacket_hdr > - pad to TPACKET_ALIGNMENT=16 > - struct sockaddr_ll > - Gap, chosen so that packet data (Start+tp_net) aligns to > TPACKET_ALIGNMENT=16 > - Start+tp_mac: [ Optional MAC header ] > - Start+tp_net: Packet data, aligned to TPACKET_ALIGNMENT=16. > - Pad to align to TPACKET_ALIGNMENT=16 > */ so the link-layer payload is always aligned on a 16-byte boundary.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
