FreeBSD's BPF data representation

[vpenkoff]

Hi guys. I'm diggin some bpf stuff and i can't figure out, why there are 3 types of data representations: words, halfwords and bytes? I mean how can i know, which one is best to use? In some basic example, e.g. for packet capture, considering BPF's manual, i use for ETHERTYPE in the ethernet header a halfword representation, but for a IP address - word representation. Can somebody explain? 10x!

[Carpetsmoker]

Hello!

This is the sort of questions that's pretty unlikely to get a decent answer on these forums.

The best place to ask is on a FreeBSD mailing list, this is where the developers hang out. freebsd-net@ seems the appropriate list. The FreeBSD handbook lists them all.

[vpenkoff]

Aw yeah.. the mailing lists! I forgot them ! Anyway, thanks! If i figure out the mystery, i'll post!

[comet--berkeley]

I read the BPF Usenix document from 1993 that I found on wikipedia:

http://en.wikipedia.org/wiki/Berkeley_Packet_Filter

http://www.tcpdump.org/papers/bpf-usenix93.pdf

The document describes a "pseudo machine" language for BPF similar to the machine languages used on a Motorola 6800 or IBM z machines.

It is big-endian (unlike Intel/AMD machines) and uses 32 bit words.

So to answer your question about why to use words, half-words and bytes.

A byte is 8 bits.
A half-word is 2 bytes or 16 bits
A word is 4 bytes or 32 bits.

The question of when to use each type is dependent on the sizes defined in the TCP/IP packet headers:

http://nmap.org/book/tcpip-ref.html

For example the ipv4 address of daemonforums.org is 94.142.245.224

This is a 4 byte word and In big-endian hexadecimal is: 0x5E8EF5E0

One can break it down into the 4 bytes:

94 = 0x5E
142 = 0x8E
245 = 0xF5
224 = 0xE0