Re: sosend and mbuf, ip header, tcp header
Re: sosend and mbuf, ip header, tcp header
- Subject: Re: sosend and mbuf, ip header, tcp header
- From: Matt Jaffa <email@hidden>
- Date: Thu, 11 Mar 2004 00:26:15 -0700
Hi Justin,
Thanks for the info,
I have that book and never no where to look, but
I should have looked at what hangs off the socket.
I am doing that with my raw filter, just didn't do it with UDP or TCP,
my mistake,
I think I am rushing through this stuff too fast that I won't really be
learning about the whole picture,
I agree with you Justin, I want to learn all aspects about sockets and
so on, but if I don't take the time to
learn all about them, then it is not going to help much.
Thanks a bunch,
Matt
On Mar 11, 2004, at 12:11 AM, Justin Walker wrote:
Hi, Matt,
On Wednesday, March 10, 2004, at 10:16 PM, Matt Jaffa wrote:
I am interested in the send function(sosend), that is the function
that
i am filtering within my app.
I am using this to extract information out of the mbuf:
[snip]
but when It prints out the information to the syslog, it is all wrong,
am i getting the ip header and the tcp header correctly out of the
mbuf structure?
I mean this only in the nicest way :-} - you *really* need to take
time and learn about the environment that you are coding for. Either
read the kernel code, or get Stevens's TCP/IP Illustrated Volume 2.
Spend time with it.
The reason everything appears all wrong is that you are looking for
something that is not there: there are no protocol headers in the mbuf
chain when you get to look at it.
If you look at the code in sosend(), you will see that, stripped to
its essentials, the sequence is roughly this:
while not done
do
get the data from the user, if necessary.
check if it's ok to send.
call the NKEs linked to the socket.
call the protocol send code (pru_send)
etc.
od
Given this, you should be able to determine that your NKE will see the
mbufs before the protocol code sees them, so all that is in the mbufs
is the data that is being passed in, either to TCP, UDP, or raw IP.
The information you seem to want is in the control blocks that dangle
off the socket. For TCP, this information (source and destination
port/address) never changes, once the session is ESTABLISHED. For UDP
or raw IP, these can change for each 'send'.
Regards,
Justin
--
Justin C. Walker, Curmudgeon-At-Large *
Institute for General Semantics | If you're not confused,
| You're not paying attention
*--------------------------------------
*-------------------------------*
_______________________________________________
darwin-kernel mailing list | email@hidden
Help/Unsubscribe/Archives:
http://www.lists.apple.com/mailman/listinfo/darwin-kernel
Do not post admin requests to the list. They will be ignored.
_______________________________________________
darwin-kernel mailing list | email@hidden
Help/Unsubscribe/Archives:
http://www.lists.apple.com/mailman/listinfo/darwin-kernel
Do not post admin requests to the list. They will be ignored.