Search code examples
bpfebpf

What does proto means, xdp/ebpf?

What does proto signifies over here, I was following this https://github.com/xdp-project/xdp-tutorial/tree/master/tracing03-xdp-debug-print Can anyone explain what proto means in this context?

$ sudo ./trace_read
src: 5a:b3:63:62:de:d7 dst: 3a:b:b:8e:5e:6a proto: 56710
src: 5a:b3:63:62:de:d7 dst: 3a:b:b:8e:5e:6a proto: 56710
src: 5a:b3:63:62:de:d7 dst: 3a:b:b:8e:5e:6a proto: 56710
Solution

  • In this context, given it seems to be displaying L2 information, proto is the Ethertype. It indicates the protocol of the next header (L3).

    56710 is 0xDD86 (in big endian) in hexadecimal, which corresponds to the Ethertype of IPv6.