Decoding Ethernet headers
If we recall how the headers are layered from this chapter's introduction, the first layer we will need to peel off is the Ethernet (Link layer) header. It looks like this:
The hardware will filter out the preamble, so we will not have access to it, but we need to retrieve the following elements:
Destination Address: This is the MAC address of the computer that this packet is being sent to
Source Address: This is the MAC address of the computer that this packet came from
Type: This is used to indicate the type of protocol that is encapsulated. Some of the common protocols are as follows:
0x0800—IPv4
0x0806—ARP
0x8035—RARP
0x86DD—IPv6
Data: This indicates the payload
Frame Check Sequence: This indicates the checksum that is added to the frame to detect transmission errors
We will build a PCAP_Headers.h file that contains the structures and constants needed to decode the various packet headers. The entries in the PCAP_Headers.h file for the Ethernet header are as follows:
//Ethernet...
