Extract payload with libpcap

shuwo · #1 (**permalink**) 4 Weeks Ago

hi!

im having a problem while extracting payload from a tcp packet that is captured with libpcap. this is what ive got so far:

PHP Code:


			
const struct ethernet_header *ethernet;
    const struct ip_header *ip;
    const struct tcp_header *tcp;
    const char *payload;
    u_int size_ip;
    u_int size_tcp;

    ip = (struct ip_header*)(packet + SIZE_ETHERNET);
    size_ip = IP_HL(ip)*4;    

    tcp = (struct tcp_header*)(packet + SIZE_ETHERNET + size_ip);
    size_tcp = TH_OFF(tcp)*4;
    
   payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);

the result look like this:

actual payload: foobar
my program shows: foobar

actual payload 2: foo
my program shows:
foo
ar

data from the last payload is still there somehow.. maybe i need to clean the memory or something after each packet.. i dunno!

hope youll understand! thanks

---------- Post updated at 11:58 AM ---------- Previous update was at 07:45 AM ----------

another question:

how do i get the correct seq and ack numbers from the tcp struct? when i print them i get just get really big numbers.. and when i check them in wireshark they should be like 1,2,3

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
Libpcap: Set a filter. (C)	Dedalus	High Level Programming	2	06-02-2009 11:25 AM
Understanding PCI Express Maximum Payload Size on OpenSolaris	iBot	Solaris BigAdmin RSS	0	12-18-2008 09:20 AM
libpcap 1.0.0 (Default branch)	iBot	Software Releases - RSS News	0	10-28-2008 09:40 PM
libpcap++ 0.0.2 (Default branch)	iBot	Software Releases - RSS News	0	04-16-2008 02:00 AM
libpcap++ 0.0.1 (Default branch)	iBot	Software Releases - RSS News	0	04-11-2008 01:10 AM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode	Rate This Thread:


	Powered by