Below is the IP structure from the library on a Linux machine
struct ip { #if __BYTE_ORDER == __LITTLE_ENDIAN unsigned int ip_hl:4; unsigned int ip_v:4; #endif #if __BYTE_ORDER == __BIG_ENDIAN unsigned int ip_v:4; unsigned int ip_hl:4; #endif u_int8_t ip_tos; u_short ip_len; u_short ip_id; u_short ip_off; #define IP_RF 0x8000 #define IP_DF 0x4000 #define IP_MF 0x2000 #define IP_OFFMASK 0x1fff u_int8_t ip_ttl; u_int8_t ip_p; u_short ip_sum; struct in_addr ip_src, ip_dst; };
for these lines:
#if __BYTE_ORDER == __LITTLE_ENDIAN unsigned int ip_hl:4; unsigned int ip_v:4; #endif #if __BYTE_ORDER == __BIG_ENDIAN unsigned int ip_v:4; unsigned int ip_hl:4; #endif
Why is enterian important in bytes? I think endianess only affects multibyte integers, but here it seems to me that endianess also affects the location of bits inside a byte?
furthermore, it is only a byte, why is it unsigned int which is 4 bytes.
I see in wirehark, ip_v and ip_hl is displayed as 0x45 if I grab the IP packet. The first byte consists of ip_v and ip_hl. I put it in the character variable x
, what is the result of x & 0b11110000 ? Is there always 4 no purpose, or can it be 5?
source share