2

I'm currently trying to parse the packets from the raw buffer. I find there seems to be two structures for ethernet header: ether_header and ethhdr. I'm kind of confused what's the difference and relationship for them? Could I use them interchangeable?

I did a quick search:

This post suggested that two identical implementation exist for IP header. Is this the case for Ethernet (and perhaps TCP, UDP, etc.)?

This patch shows the efforts to change from one implementation from one to the other. I'm not sure the incentive behind this: perhaps one implementation is somehow "better"?

Thanks!

zzy
  • 751
  • 1
  • 13
  • 25

1 Answers1

5

In Linux, the ethhdr struct is defined in uapi/linux/if_ether.h It's placement in a kernel uapi (user-space API) header file solidifies it as a stable definition to default to.

The ether_header struct has been defined in numerous locations over the years. The number of definitions and references to those definitions has been declining over time as code migrates to using ethhdr (as you observed in the patch you linked to).

An easy way to see see this progression is by looking at kernel source cross referencer output over time. The following list depicts the number of ether_header definitions/references for a few kernel versions over time:

For comparison, here are the results when looking up ethhdr:

chuckx
  • 6,484
  • 1
  • 22
  • 23
  • 1
    Thank you so much!!!! That detailed explanation indeed helps a lot!! (BTW, there seems to be a minor typo for the total number of `ethhdr` - it's 193 rather than 93.) – zzy Jun 04 '18 at 17:31
  • 1
    Good eye. Corrected it. – chuckx Jun 04 '18 at 17:42