Ethereal-users: Re: [Ethereal-users] ACK / SEQ/ flag /win wrong

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Joe Elliott <joe@xxxxxxxxx>
Date: Fri, 14 Oct 2005 20:29:29 -0700 (PDT)
Hello Servando,
	Its a precision problem, When you print data values of less than 32bits you need to use the correct printf value.
%d on your system is a full integer value. See the printf/sprintf man page on any unix system:


   The length modifier
       Here, ‘integer conversion’ stands for d, i, o, u, x, or X conversion.

       hh     A following integer conversion corresponds to a signed char or unsigned char argument, or a following n conversion corre-
              sponds to a pointer to a signed char argument.

       h      A following integer conversion corresponds to a short int or unsigned short int argument, or  a  following  n  conversion
              corresponds to a pointer to a short int argument.

       l      (ell) A following integer conversion corresponds to a long int or unsigned long int argument, or a following n conversion
              corresponds to a pointer to a long int argument, or a following c conversion corresponds to a wint_t argument, or a  fol-
              lowing s conversion corresponds to a pointer to wchar_t argument.

       ll     (ell-ell).   A  following integer conversion corresponds to a long long int or unsigned long long int argument, or a fol-
              lowing n conversion corresponds to a pointer to a long long int argument.

       L      A following a, A, e, E, f, F, g, or G conversion corresponds to a long double argument.  (C99 allows %LF, but SUSv2  does
              not.)

       q      (‘quad’. BSD 4.4 and Linux libc5 only. Don’t use.)  This is a synonym for ll.

       j      A following integer conversion corresponds to an intmax_t or uintmax_t argument.

       z      A  following  integer conversion corresponds to a size_t or ssize_t argument. (Linux libc5 has Z with this meaning. Don’t
              use it.)

       t      A following integer conversion corresponds to a ptrdiff_t argument.

You will then print the correct value.

Joe.

                                          __o       _~o       __o
                                         `\<,      `\<,      `\<,
 ______________________________________(*)/_(*)__(*)/_(*)__(*)/_(*)________
 Im a 21st Century Digital Boy ... I aint got a life, but I got lotsa toys.
 *************** Joe Elliott  joe@xxxxxxxxx  AOL:xqos  ********************
 -   NetContExt  - sniffer trace forensics - tcp follow stream analysis   - 
          Extract data files and Images from packet payloads
                  Inetd.Com    http://www.inetd.com
 --------------------------------------------------------------------------


On Fri, 14 Oct 2005, Servando Garcia wrote:

> Date: Fri, 14 Oct 2005 21:38:46 -0500
> From: Servando Garcia <servando@xxxxxxx>
> Reply-To: Ethereal user support <ethereal-users@xxxxxxxxxxxx>
> To: Ethereal user support <ethereal-users@xxxxxxxxxxxx>
> Subject: [Ethereal-users] ACK / SEQ/ flag /win wrong
> 
> Hello List
> 	First of all that you all who have helped me with this project. Now to 
> the meat of my email
> I am working on a Mac 10.3
> I am using pcap to read/translate a capture session to human readable 
> form.
> When I use ethereal to view the capture session, I get
> Acknowledgment : 450
> Sequence number :1
> Flag of 0X0010(ack)
> win:  6432
> 
> when I run my program I get
> Seq : 46517
> ACK number : 15682
> Flag 6144
> win: 65535
> 
> this is nothing like ethereal.
> 
> Here is now I call them:
>          printf("Sequence Number:%d\n",ntohs(tcp->th_seq));
>          printf("TCP Acknowledgment Number: %d\n",ntohs(tcp->th_ack));
>          printf("TCP Flags: %d\n",ntohs(tcp->th_flags));
>          printf("TCP Window Size: %d\n",ntohs(tcp->th_win));
> 
> here is how I define:
> 
> 
> struct sniff_tcp {
>          u_char  th_flags;
>          #define TH_FIN  0x01
>          #define TH_SYN  0x02
>          #define TH_RST  0x04
>          #define TH_PUSH 0x08
>          #define TH_ACK  0x10
>          #define TH_URG  0x20
>          #define TH_ECE  0x40
>          #define TH_CWR  0x80
>          #define TH_FLAGS        
> (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
>          u_short th_win;                 /* window */
> 
> I am not sure why I have this difference.
> 
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>