Question

I have to do a sniffer as an assignment for the security course. I am using C and the pcap library. I got everything working well (since I got a code from the internet and changed it). But I have some questions about the code.

u_int ip_len = (ih->ver_ihl & 0xf) * 4;   

ih is of type ip_header, and its currently pointing the to IP header in the packet.
ver_ihl gives the version of the IP.
I can’t figure out what is: & 0xf) * 4;

Answer 1

& is the bitwise and operator, in this case you’re anding ver_ihl with 0xf which has the effect of clearing all the bits other than the least signifcant 4

0xff & 0x0f = 0x0f

ver_ihl is defined as first 4 bits = version + second 4 = Internet header length. The and operation removes the version data leaving the length data by itself. The length is recorded as count of 32 bit words so the *4 turns ip_len into the count of bytes in the header

In response to your comment:

bitwise and ands the corresponding bits in the operands. When you and anything with 0 it becomes 0 and anything with 1 stays the same.

0xf = 0x0f = binary 0000 1111

So when you and 0x0f with anything the first 4 bits are set to 0 (as you are anding them against 0) and the last 4 bits remain as in the other operand (as you are anding them against 1). This is a common technique called bit masking.

http://en.wikipedia.org/wiki/Bitwise_operation#AND