FreeBSD's BPF data representation
Hi guys. I'm diggin some bpf stuff and i can't figure out, why there are 3 types of data representations: words, halfwords and bytes? I mean how can i know, which one is best to use? In some basic example, e.g. for packet capture, considering BPF's manual, i use for ETHERTYPE in the ethernet header a halfword representation, but for a IP address - word representation. Can somebody explain? 10x!
This is the sort of questions that's pretty unlikely to get a decent answer on these forums.
The best place to ask is on a FreeBSD mailing list, this is where the developers hang out. freebsd-net@ seems the appropriate list. The FreeBSD handbook lists them all.
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
I read the BPF Usenix document from 1993 that I found on wikipedia:
The document describes a "pseudo machine" language for BPF similar to the machine languages used on a Motorola 6800 or IBM z machines.
It is big-endian (unlike Intel/AMD machines) and uses 32 bit words.
So to answer your question about why to use words, half-words and bytes.
A byte is 8 bits.
A half-word is 2 bytes or 16 bits
A word is 4 bytes or 32 bits.
The question of when to use each type is dependent on the sizes defined in the TCP/IP packet headers:
For example the ipv4 address of daemonforums.org is 126.96.36.199
This is a 4 byte word and In big-endian hexadecimal is: 0x5E8EF5E0
One can break it down into the 4 bytes:
94 = 0x5E
142 = 0x8E
245 = 0xF5
224 = 0xE0
|Thread||Thread Starter||Forum||Replies||Last Post|
|Data modeling software||sutures||FreeBSD General||1||24th September 2011 02:34 PM|
|Is this an accurate representation of market share?||guitarscn||OpenBSD General||1||24th January 2010 06:03 PM|
|Mounting FreeBSD Data on Windows||tuck||Other OS||11||13th February 2009 10:19 AM|
|Data Structures in C||JMJ_coder||Programming||9||6th November 2008 02:22 AM|
|data recovery.||LateNiteTV||FreeBSD General||8||29th August 2008 08:11 PM|