tcpdump mailing list archives
tcp sequence and ack number with libpcap
From: Andrej van der Zee <andrejvanderzee () gmail com>
Date: Thu, 19 Aug 2010 23:23:39 +0900
Hi, I am trying to get the TCP sequence and ack number of TCP packets. Somehow I get different values than "tcpdump -vv" does. The numbers are way too big all the time. Source and destination ports are just fine. Below the relevant code. I studied the tcpdump source code but can't find why. Please help, I am stuck! Thank you, Andrej #define ETHER_HDRLEN 14 typedef u_int32_t tcp_seq; struct tcphdr { u_int16_t th_sport; /* source port */ u_int16_t th_dport; /* destination port */ tcp_seq th_seq; /* sequence number */ tcp_seq th_ack; /* acknowledgement number */ u_int8_t th_offx2; /* data offset, rsvd */ u_int8_t th_flags; u_int16_t th_win; /* window */ u_int16_t th_sum; /* checksum */ u_int16_t th_urp; /* urgent pointer */ }; static void handle_packet(unsigned char * ifile, const struct pcap_pkthdr * h, const u_char * sp) { const struct ip * ip = (struct ip *) (sp + ETHER_HDRLEN); const struct tcphdr * tcp_hdr = (const struct tcphdr *)(sp + ETHER_HDRLEN + sizeof(struct iphdr)); tcp_seq seq = htonl(tcp_hdr->th_seq); tcp_seq ack = htonl(tcp_hdr->th_ack); fprintf(stdout,"seq %u ack %u", seq, ack); } - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- tcp sequence and ack number with libpcap Andrej van der Zee (Aug 19)
- Re: tcp sequence and ack number with libpcap Mark Bednarczyk (Aug 19)
- Re: tcp sequence and ack number with libpcap Andrej van der Zee (Aug 19)
- Re: tcp sequence and ack number with libpcap Gert Doering (Aug 19)
- Re: tcp sequence and ack number with libpcap Gianluca Varenni (Aug 19)
- Re: tcp sequence and ack number with libpcap Andrej van der Zee (Aug 19)
- Re: tcp sequence and ack number with libpcap Eloy Paris (Aug 19)
- Re: tcp sequence and ack number with libpcap Gianluca Varenni (Aug 19)
- Re: tcp sequence and ack number with libpcap Andrej van der Zee (Aug 19)
- Re: tcp sequence and ack number with libpcap Rick Jones (Aug 19)
- Re: tcp sequence and ack number with libpcap Eloy Paris (Aug 19)
- Re: tcp sequence and ack number with libpcap Andrej van der Zee (Aug 19)
- Re: tcp sequence and ack number with libpcap Mark Bednarczyk (Aug 19)