请教个ldd3网卡驱动snull的源码

/*
* Transmit a packet (low level interface)
*/
static void snull_hw_tx(char *buf, int len, struct net_device *dev)
{
        /*
         * This function deals with hw details. This interface loops
         * back the packet to the other snull interface (if any).
         * In other words, this function implements the snull behaviour,
         * while all other procedures are rather device-independent
         */
        struct iphdr *ih;
        struct net_device *dest;
        struct snull_priv *priv;
        u32 *saddr, *daddr;
        struct snull_packet *tx_buffer;
   
        /* I am paranoid. Ain't I? */
        if (len < sizeof(struct ethhdr) + sizeof(struct iphdr)) {
                printk("snull: Hmm... packet too short (%i octets)\n",
                                len);
                return;
        }

        if (0) { /* enable this conditional to look at the data */
                int i;
                PDEBUG("len is %i\n" KERN_DEBUG "data:",len);
                for (i=14 ; i<len; i++)
                        printk(" %02x",buf&0xff);
                printk("\n");
        }
        /*
         * Ethhdr is 14 bytes, but the kernel arranges for iphdr
         * to be aligned (i.e., ethhdr is unaligned)
         */
        ih = (struct iphdr *)(buf+sizeof(struct ethhdr));
        saddr = &ih->saddr;
        daddr = &ih->daddr;

        ((u8 *)saddr)[2] ^= 1; /* change the third octet (class C) */
        ((u8 *)daddr)[2] ^= 1;
                 ----------------------------------------------------
                 请教上边两句代码是什么意思？

        ih->check = 0;         /* and rebuild the checksum (ip needs it) */
        ih->check = ip_fast_csum((unsigned char *)ih,ih->ihl);

        if (dev == snull_devs[0])
                PDEBUGG("%08x:%05i --> %08x:%05i\n",
                                ntohl(ih->saddr),ntohs(((struct tcphdr *)(ih+1))->source),
                                ntohl(ih->daddr),ntohs(((struct tcphdr *)(ih+1))->dest));
        else
                PDEBUGG("%08x:%05i <-- %08x:%05i\n",
                                ntohl(ih->daddr),ntohs(((struct tcphdr *)(ih+1))->dest),
                                ntohl(ih->saddr),ntohs(((struct tcphdr *)(ih+1))->source));

        /*
         * Ok, now the packet is ready for transmission: first simulate a
         * receive interrupt on the twin device, then  a
         * transmission-done on the transmitting device
         */
        dest = snull_devs[dev == snull_devs[0] ? 1 : 0];
        priv = netdev_priv(dest);
        tx_buffer = snull_get_tx_buffer(dev);
        tx_buffer->datalen = len;
        memcpy(tx_buffer->data, buf, len);
        snull_enqueue_buf(dest, tx_buffer);
        if (priv->rx_int_enabled) {
                priv->status |= SNULL_RX_INTR;
                snull_interrupt(0, dest, NULL);
        }

        priv = netdev_priv(dev);
        priv->tx_packetlen = len;
        priv->tx_packetdata = buf;
        priv->status |= SNULL_TX_INTR;
        if (lockup && ((priv->stats.tx_packets + 1) % lockup) == 0) {
                /* Simulate a dropped transmit interrupt */
                netif_stop_queue(dev);
                PDEBUG("Simulate lockup at %ld, txp %ld\n", jiffies,
                                (unsigned long) priv->stats.tx_packets);
        }
        else
                snull_interrupt(0, dev, NULL);
}

请各位大牛指教。

不明白为什么跟第三个字节异或。

我以为是要取得子网号，但是似乎说不通。