总结一下，长点记性：
Bit Field总是从低地址往高地址计算。
DNS的网络数据中有两个字节的标志位（下面来自真实数据）：
0x81 0x80
这个标志位分别表示：
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...1 .... .... = Recursion desired: Do query recursively
.... .... 1... .... = Recursion available: Server can do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
想都没有再想，下意识地写了下面的结构体（恶梦开始了）：
struct NetworkOrder
{
union{
unsigned short Flags;
struct{
unsigned short Response:1;
unsigned short Opcode:4;
unsigned short Authoritative:1;
unsigned short Truncated:1;
unsigned short RecursionDesired:1;
unsigned short RecursionAvailable:1;
unsigned short Zero:1;
unsigned short AnswerAuthenticated:1;
unsigned short Pad:1;
unsigned short ReplyCode:4;
};
};
};
解析结果当然不对：
{
Flags = 0x8081,
{
Response = 0x1,
Opcode = 0x0,
Authoritative = 0x0,
Truncated = 0x0,
RecursionDesired = 0x1,
RecursionAvailable = 0x0,
Zero = 0x0,
AnswerAuthenticated = 0x0,
Pad = 0x0,
ReplyCode = 0x8
}
}
然后又下意识地想（其实根本没有经过想的过程，要不然也不会这么惨了），可能是字节序的问题，换成主机序：
struct NetworkOrder
{
union{
unsigned short Flags;
struct{
unsigned short Response:1;
unsigned short Opcode:4;
unsigned short Authoritative:1;
unsigned short Truncated:1;
unsigned short RecursionDesired:1;
unsigned short RecursionAvailable:1;
unsigned short Zero:1;
unsigned short AnswerAuthenticated:1;
unsigned short Pad:1;
unsigned short ReplyCode:4;
};
};
};
我靠，结果还不对：
{
Flags = 0x8081,
{
Response = 0x1,
Opcode = 0x0,
Authoritative = 0x0,
Truncated = 0x0,
RecursionDesired = 0x1,
RecursionAvailable = 0x0,
Zero = 0x0,
AnswerAuthenticated = 0x0,
Pad = 0x0,
ReplyCode = 0x8
}
}
这个时候背上直冒冷汗，这么简单的问题自己都没搞定，快速从脑海中扫了一遍char、short、int在处理数据上的差异......想了半天，
只好用最后的笨办法了，看一下到底是怎么回事，再次改变一下结构：
struct NetworkOrder3
{
union{
unsigned short Flags;
struct{
unsigned short A0:1;
unsigned short A1:1;
unsigned short A2:1;
unsigned short A3:1;
unsigned short B0:1;
unsigned short B1:1;
unsigned short B2:1;
unsigned short B3:1;
unsigned short C0:1;
unsigned short C1:1;
unsigned short C2:1;
unsigned short C3:1;
unsigned short D0:1;
unsigned short D1:1;
unsigned short D2:1;
unsigned short D3:1;
};
};
};
结果出来一看，恍然大悟：
{
Flags = 0x8081,
{
A0 = 0x1,
A1 = 0x0,
A2 = 0x0,
A3 = 0x0,
B0 = 0x0,
B1 = 0x0,
B2 = 0x0,
B3 = 0x1,
C0 = 0x0,
C1 = 0x0,
C2 = 0x0,
C3 = 0x0,
D0 = 0x0,
D1 = 0x0,
D2 = 0x0,
D3 = 0x1
}
}
我靠，平时Bit Field用得少，老是一个字节，两个字节地考虑，忘了它从低地址开始一位一位往上计算的，修改最后的结构，得到正确的结果：
struct NetworkOrder4
{
union{
unsigned short Flags;
struct{
unsigned short RecursionDesired:1;
unsigned short Truncated:1;
unsigned short Authoritative:1;
unsigned short Opcode:4;
unsigned short Response:1;
unsigned short ReplyCode:4;
unsigned short Pad:1;
unsigned short AnswerAuthenticated:1;
unsigned short Zero:1;
unsigned short RecursionAvailable:1;
};
};
};
结果：
{
Flags = 0x8081,
{
RecursionDesired = 0x1,
Truncated = 0x0,
Authoritative = 0x0,
Opcode = 0x0,
Response = 0x1,
ReplyCode = 0x0,
Pad = 0x0,
AnswerAuthenticated = 0x0,
Zero = 0x0,
RecursionAvailable = 0x1
}
}
真是惭愧啊，好记性不如烂笔头，记在这里引以为签。