Hai everybody,
I am trying to reconstruct a HTTP session.I am asked to compare SEQ and ACK numbers. I have checked for connection establishment.Then i have recognised the Request and Response packets.Now I need to check the SEQ and ACK numbers of response packet alone..I need help how to do this.
Here is my code:
Code:
#include <netinet/if_ether.h>
#include <stdlib.h>
#include <pcap.h>
#include <errno.h>
#include <stdio.h>
#include<netinet/ip.h>
#include<netinet/tcp.h>
#include<string.h>
#define MAXBYTES2CAPTURE 2048
pcap_dumper_t *dump;
void setfilter(pcap_t * capture, char filter_app[]);
void dump_offline(pcap_t * capture, char *filename);
void view_offline(char *filename);
int a[3] = { 0, 0, 0 };
int seq;
struct http_stat {
int connection;
int packets;
} httpstatus;
struct http_request {
char response;
int packets1;
} httprequest;
struct http_response
{
int packets;
int response_code;
}httpresponse;
void process_pkt(u_char * str, const struct pcap_pkthdr *pkthdr,
const u_char * packet)
{
int dst=8080;
int in, pos = 0, pos1 = 0;
static int cnt;
u_char *ptr;
struct ether_header *eptr;
struct ip *iphdr;
struct tcphdr *tcp;
static int count = 1, i;
httprequest.packets1 = 0;
printf("Call back:");
fprintf(stdout, "%d,\n", count);
count++;
//Here i have code for printing ethernet header and IP address
iphdr = (struct ip *) (packet + sizeof(struct ether_header));
if (iphdr->ip_p == IPPROTO_TCP) {
tcp =(struct tcphdr *) (packet + sizeof(struct ether_header) + sizeof(struct ip));
packet =(const char *) (packet + sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
if (tcp->syn && tcp->ack)
a[1] = 1;
else if (tcp->syn)
a[0] = 1;
else if (tcp->ack)
a[2] = 1;
}
if (a[0] == 1 && a[1] == 1 && a[2] == 1) {
cnt++;
if (cnt == 1) {
httpstatus.connection = 1;
printf("connection established\n");
}
httpstatus.connection = 0;
}
if((tcp->source)==dst && !(tcp->psh)) // This is to find REsponse packet
{
seq=tcp->seq;
/* I want to compare previous packet's seq number and current packets ack num. How should i do this. With too many structures and variables i struggle to manipulate.. Please help!! */
if(seq==tcp->ack_seq)
printf("ACK is equals to SEQ");
}
for (i=0;i<pkthdr->len; i++)
printf("%c", packet[i]);
printf("\n");
}