peradox

Ok, I've been learning some raw sockets, which involved learning about the tcphdr, etc structures; Now I have found out that when I try to extract the port numbers (the source and dest fields) from the TCP header structure, I need to use ntohs() to get correct numbers. If it makes any difference, I'm using the non-BSD version (#ifndef __FAVOR_BSD)

However, when I compare my sniffer with tcpdump, tcpdump gets different sequence and acknowledgement numbers than my sniffer. Now to the question:
Do I need to use ntohs() on the other fields? (I am assuming no, because all the other fields are declared outside of the Pre-Processor if-else sequence relating to the endian)

Or maybe is it normal that I get different seq and ack numbers than tcpdump; because I have tried with both ntohs() and without, and have gotten different numbers anyway. (Yes, I used the -S option on tcpdump).

And also, If I am totally out in the blue, could someone give me a shove in the right direction?

Thanks!!!

bithub

Pass -S to tcpdump to get absolute instead of relative sequence numbers.

peradox

So yah...

bithub

oops, somehow I missed that. Are your sequence numbers correct in their incrementation, or are they off? Do they match the ACK numbers?

peradox

Yes, they are correct, as they match the ACK numbers, etc...
They are just not the same as tcpdump...
I'm going to try how it is with ethereal...

bithub

ethereal uses the same packet capture library as tcpdump, so the results should be the same.

Xipher

With network packets, every thing but the data itself (and sometimes even then, depends on the applications protocol) is in network (big endian I believe) byte order, so yes, you do need to use the network to host calls. Now on some archetectures, its not required, since they already use that format, but its better to use them any ways, so your program can be compiled on other archs with less hassle. So IP header, TCP header, UDP, SCTP, all should have thier sections in network byte order.

__________________
If any part of my post is incorrect, please correct me.

This post is not guarantied to be correct, and is not to be taken as a matter of fact, but of opinion or a guess, unless otherwise noted.