Newbie netfi;ter question

Newbie netfi;ter question

[Ken Kachnowich]

Hi,

   I have created a very simple module to use netfilters. I
display some info from the sk_buff structures.
The protocol field always has an 8 in it.

What does the 8 mean? I would expect this to indicate this is
an IP packet of some type, but so far I have not found a header
or any docs that explains it. Where would be a good place for me
to find these things out (please don't say read the kernel source).

Thanks,

Ken

Re: Newbie netfi;ter question

[Ralf Spenneberg]

Am Sam, 2003-05-10 um 16.05 schrieb Ken Kachnowich:
> Hi,
> 
>    I have created a very simple module to use netfilters. I
> display some info from the sk_buff structures.
> The protocol field always has an 8 in it.
If you are reading the ethernet header, the protocol field is supposed
to be 8!

> 
> What does the 8 mean? I would expect this to indicate this is
> an IP packet of some type, but so far I have not found a header
> or any docs that explains it. Where would be a good place for me
> to find these things out (please don't say read the kernel source).
8 means IP (in the ethernet header).

Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:                    
http://honeynet.spenneberg.org