I found that there seems to be a problem in the eBPF sample source code of the Linux kernel samples/bpf/sockex3_user.c. This program contains the following code:
printf("%s.%05d -> %s.%05d%12lld%12lld",
inet_ntoa((structin_addr){htonl(next_key.src)}),
next_key.port16[0],
inet_ntoa((structin_addr){htonl(next_key.dst)}),
next_key.port16[1],
value.bytes, value.packets);
the "port16[0]" is the source port and the "port16[1]" is the destination port. I found that "ports" was obtained in the following way when I view the samples/bpf/sockex3_kern.c:
g->flow.ports = load_word(skb, nhoff);
The byte order of my host is Little-Endian. In this case, port[1] should be the source port, while port[0] is the destination port.I tested this on my machine. Is this an error in this example？I hope I can get your answers and help.
