Re: regarding offset IP packet

[Guy Harris <guy () alum mit edu>]

David Rosal wrote:

> ip_off is an u_short, so byte order issues apply. Try this:
>
>     printf("%d|", ntohs(ippkt->ip_off));

...and then remember that the upper 3 bits of that 16-bit field are flags:

#define IP_RF 0x8000                    /* reserved fragment flag */
#define IP_DF 0x4000                    /* dont fragment flag */
#define IP_MF 0x2000                    /* more fragments flag */
#define IP_OFFMASK 0x1fff               /* mask for fragmenting bits */

so you need to AND the result with 0x1fff to get the offset, and test 
the other bits to see if "don't fragment" or "more fragments" is set.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.