tcpdump mailing list archives
Re: Getting TCP packet payload length with pcap
From: "Luis Martín García" <luis.mgarc () gmail com>
Date: Wed, 8 Aug 2007 12:31:21 +0200
The only difference between the structure definitions that you are using and the sniffex_XXX ones is probably the name of the structure members. The process detailed in http://www.tcpdump.org/lists/workers/2005/05/msg00021.html is correct, just check that you translate the struct member names to the equivalents for netinet/ip.h etc. Regards, Luis. NOTE: You might want to know that there are two ways to define a tcp structure, the Linux way and the BSD way. You are probably using the Linux definition 'cause the BSD one matches the sniff_tcp, check wikipedia entry "tcphdr" for more information. On 8/8/07, Nick Chorley <nick.chorley () gmail com> wrote:
Hi, I have found another post in the mailing list about this ( http://www.tcpdump.org/lists/workers/2005/05/msg00021.html), but it appears to use structs sniff_ip and sniff_tcp that are declared in the sniffex program. In my program, I'm using the structs for the IP and TCP headers as defined in netinet/ip.h and netinet/tcp.h, respectively. Is there a way to get the TCP payload length using these, or do I necessarily need to "create" my own structs? On another (unrelated note), is there no search facility for the mailing lists? Regards, Nicky Chorley - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Getting TCP packet payload length with pcap Nick Chorley (Aug 08)
- Re: Getting TCP packet payload length with pcap Luis Martín García (Aug 08)
- Re: Getting TCP packet payload length with pcap Nick Chorley (Aug 08)
- Re: Getting TCP packet payload length with pcap Nick Chorley (Aug 08)
- Re: Getting TCP packet payload length with pcap Luis Martín García (Aug 08)