问题
I am attempting to identify the ether type of a packet that I am receiving. The ether type ID is 608 and has no corresponding definition in Ethertype.h(libpcap 1.2.1). The majority of the packets received have an either type of 8 which again has no corresponding definition in Ethertype.h. Does anyone have any ideas of what the cause may be behind this or should I contact TCPDump with an error report.
回答1:
What is the return value of pcap_datalink() on the pcap_t on which you're capturing?
If it's not DLT_EN10MB (which has the value 1), your packets aren't Ethernet packets, and you shouldn't parse them as Ethernet packets.
If it is DLT_EN10MB, then is that hex 608 or decimal 608? If it's decimal 608, it's a length field rather than a type field. The same applies to 8, which is the same decimal or hex and would thus be a length value rather than a type value.
回答2:
From manpage:
"The ntohs() function converts the unsigned short integer netshort from network byte order to host byte order.".
From my code:
if(ntohs(ethernet->ether_type)==0x0800) ...
来源：https://stackoverflow.com/questions/9760837/pcap-ethertype-return