divert sock api q

[Julian Elischer]

Charles Swiger wrote:

> On Jun 7, 2005, at 1:14 PM, Julian Elischer wrote:
>
>>> I apologize for being so exceptionally dense, this is driving me  
>>> completely up the walls..
>>
>>
>> if you are receiving the entire IP packet in user space (first byte  
>> is 0x42 or 0x45 usually) then you need to update teh packet length  
>> field of the IP packet, as well as changing the number of bytes  
>> written back.
>
>
> I agree with your suggestion, but how can you have an ip_vhl of  
> 0x42?  Doesn't a valid IP packet need to have a header length of at  
> least 5 (5 << 2 == 20 bytes)?
>

huh?
the first byte of an IP packet is not the length.. the first byte you 
see on a
packet trace will be the 4 bit version followed by a 4 bit  HEADER length,
followed by 8 bits of TOS (type of Service) and 16 bits of total packet 
length.

you need to change the 16 bit value..
(it's in big-endian format.. beware)