Search code examples
cpacket-capturepcappacket-sniffers

printing sequence number of a sniffed packet

i am using pcap to create a packet sniffer.
i have this tcp structure: 

typedef struct TSP_header{  
  unsigned short int   sport;  
  unsigned short int   dport;  
  unsigned int         seqnum;  
  unsigned int         acknum;  
  unsigned char        reserved:4, offset:4;  
  unsigned int
    tcp_res1:4,       //little-endian  
    tcph_hlen:4,      //length of tcp header in 32-bit words  
    tcph_fin:1,       //Finish flag "fin"  
    tcph_syn:1,       //Synchronize sequence numbers to start a   connection
    tcph_rst:1,       //Reset flag   
    tcph_psh:1,       //Push, sends data to the application  
    tcph_ack:1,       //acknowledge  
    tcph_urg:1,       //urgent pointer  
    tcph_res2:2;
  unsigned short int tcph_win;  
  unsigned short int tcph_chksum;  
  unsigned short int tcph_urgptr;  
}TSP_header;

how can i print the sequence number?
should i use htons(sequence_number)?? because it isn't working this way!!

my other question is what is the number after the variable declaration?
what does 4 mean in tcph_hlen:4

Solution

  • If the programming language is C, note your struct is incorrect since you do not specify the sizes of the fields. For instance, the sequence number is 32 bits and "int" may be 16 or 64 bits. For seqnum, you should use uint32_t.

    This being said, if you have read the TCP packet from the network, the sequence number is in network order (big-endian) and therefore, to print it, you need to call ntohl (network to host - long).