Re: [tcpdump-workers] complete struct for tcp_header

2005-07-12 Thread Guy Harris
On Jul 12, 2005, at 3:42 AM, Thinh Ho wrote: Thanks for your reply! Extracting the data is where I am stuck... The struck of option is below: typedef struct option { byte byte1; byte byte2; byte byte3; } option; An option might have fewer than, or more than, three bytes. For that reason, ne

Re: [tcpdump-workers] complete struct for tcp_header

2005-07-12 Thread Thinh Ho
Thanks for your reply! Extracting the data is where I am stuck... The struck of option is below: typedef struct option { byte byte1; byte byte2; byte byte3; } option; I created a method in main to display the timestamp: void display_tsopt(const u_char *pkt_data, tcp_header* tcp, long &val, long

Re: [tcpdump-workers] complete struct for tcp_header

2005-07-11 Thread Guy Harris
Thinh Ho wrote: Is there a struct for the options field of tcp_header? No. That field is variable in both length and contents, so there can't be a C-language data structure for it (and I don't know whether any language has a concept of "data structure", in the sense in which it's used in la

Re: [tcpdump-workers] complete struct for tcp_header

2005-07-11 Thread Thinh Ho
Is there a struct for the options field of tcp_header? On 7/9/05, rootclown <[EMAIL PROTECTED]> wrote: > dear Thinh Ho: > get tcp header with the following way > > struct ethhdr *eth; > struct iphdr *ip; > struct tcphdr *tcp; > > eth=(struct ethhdr *)packet; > ip=(struc

Re: [tcpdump-workers] complete struct for tcp_header

2005-07-08 Thread rootclown
dear Thinh Ho: get tcp header with the following way struct ethhdr *eth; struct iphdr *ip; struct tcphdr *tcp; eth=(struct ethhdr *)packet; ip=(struct iphdr *)(eth+1); tcp=(struct tcphdr *)((u_char *)ip+(ip->ihl<<2)); and you can see linux/tcp.h for deta

[tcpdump-workers] complete struct for tcp_header

2005-07-08 Thread Thinh Ho
Hello, I am new to the mailing list and also new to pcap, tcpdump, and tcp, in general. I am trying to capture tcp packets and extract/print all its fields in readable format. The sniffer works and I was able to print out the whole packet (in hex) and confirmed it with Ethereal. The struct I have f