searching for a string in the data contents of a socket buffer

From: Jeff Heath (jheath1_at_optonline.net)
Date: 11/19/03

  • Next message: J.D. Spangler: "Re: Eudora mail and Favorites transfer to Linux"
    Date: 18 Nov 2003 22:04:44 -0800
    
    

    I'm trying to search for character stings in the payload of udp
    packets inside a socket buffer (in the kernel before the socket buffer
    has been copied to user space).

    I'm doing this on an Intel machine. Intel uses little endian byte
    order. The packets come across the network in big endian byte order.

    If I start at the data head inside the skb and advance one byte at a
    time will I see the bytes as they came across the network or will the
    little endian byte order screw things up. i.e. is the payload stored
    in the skb as 4 Byte words as such:

    bytes as they come across the network:

    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, ...

    bytes in main memory (4 byte words in little endian byte order)

    3, 2, 1, 0, 7, 6, 5 ,4

    I'm searching for strings, so I need to see the bytes as they were
    transmitted. If I want to inspect the packet contents one byte at a
    time, can I just do this...

    unsigned char *p_data = skb->data;
    while (*pdata != 0x20) {
          do_stuff();
          pdata++;
    }

    or will advancing the pointer one byte at a time yield the wrong
    order? i.e. 3, 2, 1, 0, 7, 6, 5, 4....


  • Next message: J.D. Spangler: "Re: Eudora mail and Favorites transfer to Linux"

    Relevant Pages

    • Re: "shadow" a user?
      ... INIT { ... if ($endian eq '0x78') { ... packets with data. ... -D Print all payload data, ...
      (AIX-L)
    • endian-ness and string searches inside an skb
      ... I'm trying to search for character stings in the payload of udp ... packets inside a socket buffer (in the kernel before the socket buffer ... The packets come across the network in big endian byte order. ...
      (comp.os.linux.development.system)
    • problem with NdisReturnPackets ( )
      ... If you queue the packets then you must alloc and copy the ... payload in the original packet descriptor. ... >If kernel debugger is available get stack backtrace. ...
      (microsoft.public.development.device.drivers)
    • Re: When did I lost packets?
      ... a few hundred packets... ... ran the setup at an even higher rate. ... than 3 seconds to overflow the socket buffer at the rate I was sending. ... And they are supposed to execute fast, ...
      (comp.unix.programmer)
    • Re: one question about socket listening port
      ... >> that user memory is much larger than socket buffer memory, ... I assumed the OP was using UDP, not TCP, since he talked about the ... server processing packets. ...
      (comp.unix.programmer)