[tcpdump-workers] Question on print-ppp.c

[Michael Haardt]

Hello,

I just came across a broken PPP PAP ACK packet which was just
4 bytes long, because it lacked the message-length octet.

pppd 2.4.5 accepts such truncated PPP PAP ACKs and only logs a debugging
message, but at least it generates 5 byte packets.  LWIP copied that code.
TI NDK accepts truncated packets as well, although it also generates them,
so perhaps it counts less.

tcpdump did not show it being truncated due to a check that prevents
that.  While that could be fixed easily with

--- ./tcpdump-4.5.1/print-ppp.c 2013-11-08 00:22:54.0 +0100
+++ ./tcpdump-4.5.1-patched/print-ppp.c 2014-03-17 19:50:42.0 +0100
@@ -946,8 +946,13 @@
break;
case PAP_AACK:
case PAP_ANAK:
-   if (length - (p - p0) < 1)
-   return;
+   /* Although some implementations ignore truncation at
+* this point and at least one generates a truncated
+* packet, RFC 1334 section 2.2.2 clearly states that
+* both AACK and ANAK are at least 5 bytes long.
+*/
+   if (len < 5)
+   goto trunc;
TCHECK(*p);
msg_len = *p;   /* Msg-Length */
p++;

I wonder if that is the right way.  I see printing other PPP packets
contains similar checks that explicitly do not print them as being
truncated.

Am I missing something here? I see nothing in the RFC about optional
fields.

Michael
___
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

[tcpdump-workers] how to tell tcpdump only to capture packets that go throught iptables

[fsluck]

how to tell tcpdump only to capture packets that go throught iptables
 
i want to calculate how many icmp packets are received  after i setup several 
iptables rules for icmp.
 
thanks
___
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

Re: [tcpdump-workers] how to tell tcpdump only to capture packets that go throught iptables

[Denis Ovsienko]

19.03.2014, 06:18, "fsluck" :
> how to tell tcpdump only to capture packets that go throught iptables

iptables can send packets to NetFilter loggger (-j NFLOG --nflog-group 20) on 
which tcpdump can capture (-i nflog:20)

> i want to calculate how many icmp packets are received  after i setup several 
> iptables rules for icmp.

Mere counting is possible even without tcpdump: each iptables rule has counters 
for bytes and packets (iptables -vnL INPUT).

-- 
Denis Ovsienko
___
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers