cardigliano at ntop
May 12, 2012, 8:16 AM
Post #2 of 2
the "displ" parameter (usually 0 or 14) contains the displacement of the ethernet header with respect to the ska->data pointer.
In a nutshell, when you have to access the packet data you should take into account "displ" when computing the offset.
u_int payload_offset = hdr->extended_hdr.parsed_pkt.offset.payload_offset - displ;
char *payload = &skb->data[payload_offset];
On May 11, 2012, at 4:50 PM, Mike Drangula wrote:
> Hi. Iím trying to write a PF_RING plugin and I need to understand the context and usage of the displ argument passed to pfring_plugin_filter_skb and pfring_plugin_handle_skb.
> Iíve been browsing the source and the real meaning of displ is not obvious.
> Thanks in advance for your help,
> Mike Drangula | Sr. Software Engineer
> Gigamon | www.gigamon.com
> Home Office: 437 Glen Rd, Sparta, NJ 07871
> Gigamon HQ: 598 Gibraltar Drive, Milpitas, CA 95035
> Office: +1.914.930.6702 | Mobile: +1.973.222.4232
> E-Mail: mike.drangula [at] gigamon
> Intelligent Traffic Visibility Networks
> Ntop-misc mailing list
> Ntop-misc [at] listgateway