Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Unicast filter for NAI Distributed Sniffer 1
- Thread starter ashari1
- Start date
-
1
- #2
Sniff4Food
Instructor
Simple. Do a binary pattern match for the last bit in the first byte of the Destination Address (the first byte in the packet). If the bit is a 0 the packet is a unicast, if it is a 1, it is either a broadcast or multicast.
More detail than you wanted to know: Ethernet transmits the bits onto the wire in reverse bit order so the last bit in the byte is really the first received. So, if the bit is a 1 and you don't support multicast, the first 0 you see, you know the address is multicast and you don't have to copy it into your buffer (all 1s would be broadcast). A quick way to tell if an address is uni, multi or broad is to look at the first byte. If it is odd, it is a multicast. If it is even, it is a unicast. If it is FF (all binary 1s), then it is a broadcast.
More detail than you wanted to know: Ethernet transmits the bits onto the wire in reverse bit order so the last bit in the byte is really the first received. So, if the bit is a 1 and you don't support multicast, the first 0 you see, you know the address is multicast and you don't have to copy it into your buffer (all 1s would be broadcast). A quick way to tell if an address is uni, multi or broad is to look at the first byte. If it is odd, it is a multicast. If it is even, it is a unicast. If it is FF (all binary 1s), then it is a broadcast.
- Status
Similar threads
- Locked
- Question