printf a bpf_u_int32

[MK27]

This is an ip address used by the pcap library. How can I get an ip address stored thusly to print?

printf ("%d\n", my_ip_int_var);

[zacs7]

Firstly it's unsigned so what you're doing won't work.

And secondly, if you want each octal (ie, a.b.c.d) just do a bitwise shift (and maybe other things ) and print. That is ofcourse if pcap provides no support for unpacking it, who's to say the type won't change from unsigned int to unsigned int64 in the future?

[tabstop]

Apparently it's a 32-bit unsigned int. In C99, you can use PRIu32 to print that.

[MK27]

And secondly, if you want each octal (ie, a.b.c.d) just do a bitwise shift (and maybe other things ) and print.

Can you give me an example of how to do this? I just googled "bitshift ip address" and surprisingly there is nothing invloving C.

I did try inet_ntoa:

bpf_u_int32 ip;   // presume a functional address in this
struct in_addr tmp;
tmp.s_addr=ip;
printf ("%s\n", inet_ntoa(tmp));

Which compiles but segfaults, which seems odd even if the byte order is wrong.

[tabstop]

Can you give me an example of how to do this? I just googled "bitshift ip address" and surprisingly there is nothing invloving C.

Some questions are too trivial even for Google. (I mean, once you realize that the 32-bits are set up as four eight-bit octets, then you're done.)

I did try inet_ntoa:

bpf_u_int32 ip;   // presume a functional address in this
struct in_addr tmp;
tmp.s_addr=ip;
printf ("%s\n", inet_ntoa(tmp));

Which compiles but segfaults, which seems odd even if the byte order is wrong.

You need to not presume a functional address, but actually make it so -- changing to

unsigned int ip = 0x0f000001;

worked for me. (You should be able to get away with your other data type too.)

Edit: I should be more specific -- I didn't actually try your version because I didn't want to bother. So my point is really that there's nothing wrong with what you've posted, so you'll have to be more specific. If it makes you feel better, I changed it to bfp_whatever and it still works.

[MK27]

unsigned int ip = 0x0f000001;

Won't that overwrite the ip address I'm trying to decipher?

Anyway, it's in little endian because this actually worked, much to my excitement:

struct ip_addr {
	unsigned char one;
	unsigned char two;
	unsigned char three;
	unsigned char four;
};

int main() {
        bpf_u_int32 ip;
	struct ip_addr *ptr=(struct ip_addr*)&ip;
        printf ("%d.%d.%d.%d\n", ptr->one,ptr->two,ptr->three,ptr->four);
}

Which I guess is a sort of bit shift.

[tabstop]

Won't that overwrite the ip address I'm trying to decipher?

Anyway, it's in little endian because this actually worked, much to my excitement:

struct ip_addr {
	unsigned char one;
	unsigned char two;
	unsigned char three;
	unsigned char four;
};

int main() {
        bpf_u_int32 ip;
	struct ip_addr *ptr=(struct ip_addr*)&ip;
        printf ("%d.%d.%d.%d\n", ptr->one,ptr->two,ptr->three,ptr->four);
}

Which I guess is a sort of bit shift.

Well my point (such as it was) is that the only possibility of error in your code was the presumed getting of data into your ip variable.

[MK27]

Well my point (such as it was) is that the only possibility of error in your code was the presumed getting of data into your ip variable.

I forgot to #include <arpa/inet.h> (has in_addr_t in it). Now I get the same result both ways.

Thanks again

ps. I guess it actually was big endian then...

[brewbuck]

who's to say the type won't change from unsigned int to unsigned int64 in the future?

The fact that an IP address is 32 bits long, and that would be pointless?