Hi,

Below is some hex data:

58 ff eb 06 c0 a8 02 05 39 10 23 d4 8b f8 84 a5 18 00 6e d9
49 2b 4f 4b 20 54 54 6d 61 69 6c 20 50 4f 50 33 20 53 65 72
76 65 72 0d 0a

When you cast the above data into struct msg, which is defined below, thSport and thDport appear to be 6ed9 and 492b, respectively. However, I expect them to be 006e and d949.

The rest (ipSrc, ipDst, thSeq, thAck, thFlags) appears to be fine.

struct msg
{
struct in_addr ipSrc, ipDst;
u_int32_t thSeq;
u_int32_t thAck;
u_char thFlags;
u_short thSport;
u_short thDport;
};

I use Ubuntu and gcc 4.2.4

Any ideas ?

Thanks.

It's an alignment issue. The variable 'thFlags' gets padded by the compiler by another byte right afterwards, and that's why there's this one byte offset.

Wikipedia

Scroll down to about halfway.