LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 12-22-2004, 11:35 AM   #1
Ephracis
Senior Member
 
Registered: Sep 2004
Location: Sweden
Distribution: Ubuntu, Debian
Posts: 1,109

Rep: Reputation: 49
Package id


I have a logger if visitors to a website and can check their ip and browser, etc. Therefore I can check what OS they are using since it is shown in the user-agent.

So I thought that I could check with hping how the id on ip packages is different on different platforms.

Here is a sample of my computer:
Code:
HPING localhost (lo 127.0.0.1): NO FLAGS are set, 40 headers + 0 data bytes
len=40 ip=127.0.0.1 ttl=64 DF id=39142 sport=0 flags=RA seq=0 win=0 rtt=0.1 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39143 sport=0 flags=RA seq=1 win=0 rtt=0.0 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39144 sport=0 flags=RA seq=2 win=0 rtt=0.0 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39145 sport=0 flags=RA seq=3 win=0 rtt=0.0 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39146 sport=0 flags=RA seq=4 win=0 rtt=0.0 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39147 sport=0 flags=RA seq=5 win=0 rtt=0.1 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39148 sport=0 flags=RA seq=6 win=0 rtt=0.0 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39149 sport=0 flags=RA seq=7 win=0 rtt=0.0 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39150 sport=0 flags=RA seq=8 win=0 rtt=0.0 ms
len=40 ip=127.0.0.1 ttl=64 DF id=39151 sport=0 flags=RA seq=9 win=0 rtt=0.1 ms

--- localhost hping statistic ---
10 packets tramitted, 10 packets received, 0% packet loss
round-trip min/avg/max = 0.0/0.1/0.1 ms
I run Linux 2.6.9 and it seems that I have different ID's. My webserver inside a little home-network on the other hand, when pinged on port 80, shows 0 on each package ID.

Anyway, I tested some boxes from my website-logs, I checked NT 5.1, NT 5.0, NT 4.0, Win98, Win95, different Linux and Macintosh. But there was no pattern. Not an obvious one at least. Most of the Windows boxes had ID 13330 on all packages and so did also the Macintoshes. Even most Linux boxes gave 13330 on every package ID.

But some (like my webserver) had 0 as ID and a few other (like my own host) had different, increasing ID.

Can someone explain what is setting this ID (it couldn't be the OS since two 98 boxes can show different ID's) and why are they different?
 
Old 12-22-2004, 01:48 PM   #2
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
It's a TCP sequence number..
Usually randomly started, but there's a pattern from each machine.. somewhere they start from..

It's used to see if packets are arriving/missing in the sequence..
 
Old 12-22-2004, 03:16 PM   #3
Ephracis
Senior Member
 
Registered: Sep 2004
Location: Sweden
Distribution: Ubuntu, Debian
Posts: 1,109

Original Poster
Rep: Reputation: 49
Yeah that I have already figured out. The thing I don't know is why some boxes always have 13330 as ID, some have 0 and some have an increasing number as their ID. What controls this behaviour and is there any sort of standard on how the ID should behave?
 
Old 12-23-2004, 04:25 AM   #4
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
No standard..

So long as the packets have a sequence..

http://www.uwsg.iu.edu/hypermail/lin...11.3/0007.html
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
latex2e package unavailable in package manager or apt-get cesine Debian 2 07-11-2006 02:31 PM
message "Problem during installation: x package needed for (installed) x package frayed2 Linux - Newbie 1 04-24-2005 07:05 PM
Is there any way to display the full name of package via dpkg -l <package pattern> ? davidas Debian 4 04-07-2004 10:00 PM
Does apt-get install <package> upgrade the package if it is already installed? davidas Debian 4 04-05-2004 06:12 PM
installing an unstable package from debian's online package archive ganninu Debian 13 11-07-2003 03:00 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:24 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration