Hello,
For each layer (protocol) in a packet I need to obtain the offset into
the packet. For example, for "eth:ip:icmp:data", the offsets would be:
eth: 0
ip: 14 (IP with no options)
icmp: 34 (ICMP echo request)
data: 42
I have been using the value of the "start" field of "struct field_info"
(epan/proto.h). However, I just found out that in some cases "start" can
be zero. For example, a packet with the following structure is giving me
a zero "start" for protocol "tcp", and offsets for the following layers
(telnet in this example), start counting from 0:
eth: 0
vlan: 14
ipv6: 18
tcp: 0
telnet: 20
What is causing field_info's "start" field to be zero is the presence of
an IPv6 fragmentation header (see below for packet details.)
The question is: is this normal behavior, and if so, is there some other
reliable way to obtain offsets into a packet from dissection results?
Thanks in advance for any suggestions.
Cheers,
Eloy Paris.-
netexpect.org
----------------------------------------------------------------------
No. Time Source Destination Protocol Info
532 124.395809 2001:db8:1:208::1047 2001:db8:1:208::20 TCP 1029 > 23 [SYN] Seq=192 Win=65535 Len=0
Frame 532 (90 bytes on wire, 90 bytes captured)
Arrival Time: May 27, 2008 15:27:19.862097000
[Time delta from previous captured frame: 0.002587000 seconds]
[Time delta from previous displayed frame: 124.395809000 seconds]
[Time since reference or first frame: 124.395809000 seconds]
Frame Number: 532
Frame Length: 90 bytes
Capture Length: 90 bytes
[Frame is marked: False]
[Protocols in frame: eth:vlan:ipv6:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: 0a:12:bc:34:ef:61 (0a:12:bc:34:ef:61), Dst: Cisco_b5:a4:1b (00:18:74:b5:a4:1b)
Destination: Cisco_b5:a4:1b (00:18:74:b5:a4:1b)
Address: Cisco_b5:a4:1b (00:18:74:b5:a4:1b)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: 0a:12:bc:34:ef:61 (0a:12:bc:34:ef:61)
Address: 0a:12:bc:34:ef:61 (0a:12:bc:34:ef:61)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 909
000. .... .... .... = Priority: 0
...0 .... .... .... = CFI: 0
.... 0011 1000 1101 = ID: 909
Type: IPv6 (0x86dd)
Trailer: B1508EC3
Internet Protocol Version 6
0110 .... = Version: 6
[0110 .... = This field makes the filter "ip.version == 6" possible: 6]
.... 0000 0000 .... .... .... .... .... = Traffic class: 0x00000000
.... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000
Payload length: 28
Next header: IPv6 fragment (0x2c)
Hop limit: 255
Source: 2001:db8:1:208::1047 (2001:db8:1:208::1047)
Destination: 2001:db8:1:208::20 (2001:db8:1:208::20)
Fragmentation Header
Next header: TCP (0x06)
0000 0000 0000 0... = Offset: 0 (0x0000)
0 = More Fragment: No
Identification: 0x00000007
[IPv6 Fragments (20 bytes): #532(20)]
[Frame: 532, payload: 0-19 (20 bytes)]
Transmission Control Protocol, Src Port: 1029 (1029), Dst Port: 23 (23), Seq: 192, Len: 0
Source port: 1029 (1029)
Destination port: 23 (23)
Sequence number: 192
Header length: 20 bytes
Flags: 0x02 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0x3b1c [correct]
[Good Checksum: True]
[Bad Checksum: False]
