Question

I’m writing a kernel module that receives Ethernet packets for Linux 2.6.31 and I’d like to extract contents of Ethernet packets from a pointer to struct sk_buff that is passed to func function of struct packet_type, which is registered by dev_add_pack. Which member of the structure should I refer to? When I sent an Ethernet packet with 46-byte body, skb->data - skb->head was 48 and skb->len was 46, where skb is a pointer to struct sk_buff.

Answer 1

you can extract the data from the sk_buff structure as…

char buff[1024];    
int i=0;
//printk("******start of the data*******\n");
while(i<((skb->tail)-(skb->data)))
buff[i]=(char *)((skb->data)[i]);

the size of buffer may differ or you can define it as u wish.

& in this buffer actually you have copied the data with the header or without header plus actual packet payload.
It depends on where you are capturing the sk_buff( i mean at which layer).
because as the packet goes from socket to NIC or from NIC to socket sk_buff’s related fields are updated.