LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices

Reply
 
Search this Thread
Old 06-21-2007, 04:57 AM   #1
Nylex
LQ Addict
 
Registered: Jul 2003
Location: London, UK
Distribution: Slackware
Posts: 7,464

Rep: Reputation: Disabled
Incorrect source/destination ports when reading tcpdump data with libpcap


I have a binary tcpdump file that I'm reading with libpcap, so I can get IP addresses, ports and timestamps out and then eventually put them in a database. I also have an ASCII version of this tcpdump file (which was generated by reading the binary file with tcpdump and then just redirecting the output) and I'm using this to compare the output of my program. My program outputs the source and destination IP addresses correctly, but not the source and destination ports, so I must be doing something wrong. Relevant code is as follows:

Code:
pcap_t *handle = pcap_open_offline(file, error_buffer);
struct pcap_pkthdr *packet_header;
const u_char *packet;
struct ip *ip_packet;
struct tcphdr *tcp_segment;

// Get one packet
packet = pcap_next(handle, packet_header);
  
ip_packet = (struct ip*)(packet + sizeof(struct ether_header));
tcp_segment = (struct tcphdr*)(packet + sizeof(struct ether_header) 
			     + sizeof(struct ip));
  
...
cout << "Source port: " << tcp_segment->source << endl;
cout << "Destination port: " << tcp_segment->dest << endl;
For the first packet in my input data, my program gives the following output:

Source port: 384
Destination port: 20480

The output from my program is the same if I have "#define __FAVOR_BSD" in my code and use the other tcphdr struct defined in <netinet/tcp.h>. My ASCII log file gives the source and destination ports as 32769 and 80 (well, http), respectively.

Any ideas? Thanks.
 
Old 06-21-2007, 05:06 AM   #2
rupertwh
Member
 
Registered: Sep 2006
Location: Munich, Germany
Distribution: Debian / Ubuntu
Posts: 297

Rep: Reputation: 49
Seems like you have to reverse the byte order using ntohs().
 
Old 06-21-2007, 05:10 AM   #3
Nylex
LQ Addict
 
Registered: Jul 2003
Location: London, UK
Distribution: Slackware
Posts: 7,464

Original Poster
Rep: Reputation: Disabled
Genius! Thanks very much .
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
source code for reading data through com port rs232 applee Programming 2 03-03-2007 08:55 AM
ifconfig ppp0 reading incorrect colabus Debian 1 02-20-2005 04:47 PM
what is the method of reading the data in a packet using Libpcap gajaykrishnan Linux - Networking 0 02-20-2005 03:29 AM
Incorrect destination addy on subnet traffic af_dave Linux - Security 5 08-29-2004 03:43 AM
Help reading TCPDUMP output BenCarlisle Linux - Networking 3 02-27-2003 03:35 PM


All times are GMT -5. The time now is 11:29 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration