Hi,
Hi Experts,
I am reading ebpf sample code recently. When I read socketx2_kern.c
socketx2_user.c, I got a question here.
__u64 proto = load_half(skb, 12);
I can not understand here: It means load 2 bytes from 12th bytes of skb
address ( it is a pointer of struct__skb_buff ).
struct __sk_buff {
__u32 len;
__u32 pkt_type;
__u32 mark;
__u32 queue_mapping;
__u32 protocol;
__u32 vlan_present;
__u32 vlan_tci;
__u32 vlan_proto;
******
}
But I found the structure as above. So the reading start point should be
at queue_mapping. But it actually reads protocol info here. *And I did
found the result is protocol info*. Why?
The v*alue of pkt_type, mark, and queue_mapping are all 0.* But when to
read starting from queue_mapping's offset, the info is about protocol.
It is a little tricky to me. I can not understand this. From my
pointview, the protocol info should start at 16 bytes.
Is there any background that is hidden from me? I search a lot and
cannot find any detailed info about this. Please help explain this.
Thanks so much.
