divert sock api q

[Charles Swiger]

On Jun 7, 2005, at 5:29 PM, Julian Elischer wrote:
>> I agree with your suggestion, but how can you have an ip_vhl of   
>> 0x42?  Doesn't a valid IP packet need to have a header length of  
>> at least 5 (5 << 2 == 20 bytes)?
>
> huh?
> the first byte of an IP packet is not the length.. the first byte  
> you see on a
> packet trace will be the 4 bit version followed by a 4 bit  HEADER  
> length,
> followed by 8 bits of TOS (type of Service) and 16 bits of total  
> packet length.

Agreed, but note that I said "header length" above, too.  The  
smallest possible IP packet, without any IP options set, has an IP  
header length of 20, yes?

http://www.ietf.org/rfc/rfc0791.txt, page 10, says:

" IHL:  4 bits

     Internet Header Length is the length of the internet header in 32
     bit words, and thus points to the beginning of the data.  Note that
     the minimum value for a correct header is 5."

...and from <netinet/ip.h>:

#define IPVERSION       4
/*
  * Structure of an internet header, naked of options.
  */
struct ip {
#ifdef _IP_VHL
         u_char  ip_vhl;                 /* version << 4 | header  
length >> 2 */
#else
#if BYTE_ORDER == LITTLE_ENDIAN
         u_int   ip_hl:4,                /* header length */
                 ip_v:4;                 /* version */
#endif
#if BYTE_ORDER == BIG_ENDIAN
         u_int   ip_v:4,                 /* version */
                 ip_hl:4;                /* header length */
#endif
[ ... ]

#define IP_VHL_BORING           0x45

0x45 means ip_v == 4 (IPv4) and ip_hl == 5 (five 32-bit words, or 20  
bytes >> 2).

> (it's in big-endian format.. beware)

Sure.  Network wire order is always big endian.  :-)

-- 
-Chuck