Question

Code snippet from here:

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    ....
    /* retireve the position of the ip header */
    ih = (ip_header *) (pkt_data +
        14); //length of ethernet header
    ....

But this image doesn’t say it’s necessarily 14:

_{(source: lewis at http://www.dcs.gla.ac.uk)}

How should I do it properly?

Answer 1

In 802.3, both the source and destination addresses are 48-bit MAC addresses. 6+6+2=14