Search code examples
networkingwiresharkpacket-sniffersbpf

Why does Bpf allow ether[0:2] and ether[0:4] but not ether[0:3]?

Why does Berkeley Packet Filter allow filtering on ether[0:2] and ether[0:4] but not ether[0:3] which is the vendor?tcpdump 'ether[0:3] = 0x000000' returns with tcpdump: data size must be 1, 2, or 4

Solution

  • This is confirmed by the pcap-filter man page (search for “byte offset”), although it does not provide additional information either.

    My guess would be that libpcap refuses to create a program that compares three bytes at a time because the classic BPF programs it generates do not have instructions to directly support such comparisons. It can load one byte, one half-word (two bytes) or one word (four bytes) into one of the registers and compare it to a value, but it is not able to work with three-byte long values.

    I suppose the workaround would be to compare the value in two steps, ether[0:2] then ether[2].