Create an account

Very important

  • To access the important data of the forums, you must be active in each forum and especially in the leaks and database leaks section, send data and after sending the data and activity, data and important content will be opened and visible for you.
  • You will only see chat messages from people who are at or below your level.
  • More than 500,000 database leaks and millions of account leaks are waiting for you, so access and view with more activity.
  • Many important data are inactive and inaccessible for you, so open them with activity. (This will be done automatically)


Thread Rating:
  • 456 Vote(s) - 3.52 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Is length of ethernet header necessarily 14?

#1
Code snippet from [here][1]:

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
....
/* retireve the position of the ip header */
ih = (ip_header *) (pkt_data +
14); //length of ethernet header
....

But this image doesn't say it's necessarily **14**:


[![alt text][2]][2]
<sub>(source: [lewis at

[To see links please register here]

](

[To see links please register here]

;


How should I do it properly?



[1]:

[To see links please register here]

[2]:
Reply

#2
In 802.3, both the source and destination addresses are 48-bit MAC addresses. 6+6+2=14
Reply

#3
The Wikipedia has a good picture of the frame

[WIKI][1]

IPv4 / v6 are layer 3 protocols.


[1]:

[To see links please register here]

Reply

#4
The ethernet header is fixed width however extension protocols such as 802.1q for vlan/qos are common and effectivly extend the L2 header.

Reply

#5
Yes, it's 14 in most cases for an end-station scenario.
Except the case when you have an 802.1Q frame, that would throw you off by another 4 bytes.
802.1Q is primarily used for VLAN tagging and QoS on router/router communication.

The preamble and start frame delimiter are mostly used by low level firmware to capture a frame.
By the time when we (application) have access to an ethernet frame, in general we don't have the preamble nor the start frame delimiter.

From what I can recall the 2 byte length of mac address was part of Ethernet I which never really gained acceptance. And the Ethernet II/802.3 that is having 6 byte addresses is the real common ethernet that we are using nowadays.

Also want to mention that the padding is 0-46, where 46 came from the minimum 64 bytes constraint on ethernet frame for collision detect (CD) purpose.
46(pad) + 14(dmac,smac,type) + 4(CRC) = 64 bytes





Reply



Forum Jump:


Users browsing this thread:
1 Guest(s)

©0Day  2016 - 2023 | All Rights Reserved.  Made with    for the community. Connected through