Hello,
Following is the tcpdump output of part of an ftp connection on a FDDI host with
Ethernet encapsulation. What I find odd about it is that the packet socket returns
strange values for h->tp_len.
Namely h->tp_len is always 2 * (ip->ip_len + 14). Where does factor 2 come from?
I don't see factor 2 on a normal Ethernet host.
01:34:29.557910 0:2:b3:1f:ba:5d 0:0:cb:c0:84:22 ip 3028: Corona.47389 > Hell.ftp-data:
. 2187169:2188617(1448) ack 1 win 5792 <nop,nop,timestamp 46444268 175817981> (DF)
[tos 0x8] (ttl 64, id 1301, len 1500)
01:34:29.559210 0:2:b3:1f:ba:5d 0:0:cb:c0:84:22 ip 3028: Corona.47389 > Hell.ftp-data:
. 2188617:2190065(1448) ack 1 win 5792 <nop,nop,timestamp 46444268 175817981> (DF)
[tos 0x8] (ttl 64, id 1302, len 1500)
01:34:29.560443 0:2:b3:1f:ba:5d 0:0:cb:c0:84:22 ip 3028: Corona.47389 > Hell.ftp-data:
. 2190065:2191513(1448) ack 1 win 5792 <nop,nop,timestamp 46444268 175817981> (DF)
[tos 0x8] (ttl 64, id 1303, len 1500)
...
01:34:29.615479 0:2:b3:1f:ba:5d 0:0:cb:c0:84:22 ip 132: Corona.47389 > Hell.ftp-data:
. [tcp sum ok] ack 2 win 5792 <nop,nop,timestamp 46444274 175817995> (DF)
(ttl 64, id 0, len 52)
Interface configuration with Linux 2.4.19:
eth0 Link encap:Ethernet HWaddr 00:00:CB:C0:84:22
inet addr:141.X.Y.Z Bcast:141.X.Y.255 Mask:255.255.255.0
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:569090565 errors:0 dropped:0 overruns:0 frame:0
TX packets:23566781 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:231659734 (220.9 Mb) TX bytes:2282823786 (2177.0 Mb)
Interrupt:10 Base address:0xd400
Regards,
-Udo.
Attachment:
pgp00036.pgp
Description: PGP signature
