Question

I’m trying to build a simple echo server/client that works on ethernet level(using raw sockets).
The server side by itself works and shows all incoming packets on eth0.
The client works and sends ethernet packets on eth0 (I checked this with wireshark and can see the packets going out.)
I now want to make a filter to only look at the packets I’m interested. (This is based on the destination/source addresses.)

In the code below, could someone please explain to me why strncmp returns zero(meaning the strings match) but yet the “if(ethernet_header->h_dest == mac)” fails to execute (don’t match).
Both the variables “mac” and “ethernet_header->h_dest” is the same type and length.

Some more background:
– This is done on linux 64bit (ubuntu)
– I’m using eth0 on the same machine for sending/receiving….I don’t think this should be a problem?

I just don’t understand why strcmp returns a match and if doesn’t. What am I missing??

void ParseEthernetHeader(unsigned char *packet, int len) {
    struct ethhdr *ethernet_header;
 unsigned char mac[ETH_ALEN] = {0x01, 0x55, 0x56, 0x88, 0x32, 0x7c}; 

 if (len > sizeof(struct ethhdr)) {
  ethernet_header = (struct ethhdr *) packet;

  int result = strncmp(ethernet_header->h_dest, mac, ETH_ALEN);
  printf("Result: %d\n", result);

  if(ethernet_header->h_dest == mac) {
   /* First set of 6 bytes are Destination MAC */
   PrintInHex("Destination MAC: ", ethernet_header->h_dest, 6);
   printf("\n");

   /* Second set of 6 bytes are Source MAC */
   PrintInHex("Source MAC: ", ethernet_header->h_source, 6);
   printf("\n");

   /* Last 2 bytes in the Ethernet header are the protocol it carries */
   PrintInHex("Protocol: ", (void *) &ethernet_header->h_proto, 2);
   printf("\n\n");
   printf("Length: %d\n",len);
  }

 } else {
  printf("Packet size too small (length: %d)!\n",len);
 }

}

Answer 1

Neither strncmp nor a naked if should be used for comparing MAC addresses.

The first won’t work properly in cases where they may have an embedded zero byte which would cause strncmp to state they’re equal when they’re actually not. That’s because a strncmp of the following two values:

ff ff 00 ff ff ff
ff ff 00 aa aa aa

would be true (it only checks up to the first zero byte).

The second won’t work because you’re comparing pointers rather than the contents that the pointers point to. If you have the following memory layout:

0x12345678 (mac) | 0x11111111 |
0x1234567c (eth) | 0x11111111 |

then comparing mac with eth with if (mac == eth) will give you false since they are distinct pointers, one ending in 78, the other in 7c.

You should use memcmp instead since it will compare the raw memory bytes without stopping at an early zero byte:

int result = memcmp (ethernet_header->h_dest, mac, ETH_ALEN);