CODEWITHSUNDEEP
tcpip
shanyy
shanyy

Reputation: 86

Strange IP packet analysis?

I use tcpdump to catch some tcp packets, when analyzing them according to ip/tcp packet schema, the packet seems to be broken. Here is a sample packet I got from tcpdump output. Is any one familiar with them?

Should not the first 4 bit of ip packet always be 0100 in under ipv4?

ip packet: https://en.wikipedia.org/wiki/IPv4

some examples: http://mike.passwall.com/networking/samplepacket.html

13:11:43.330397 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    172.16.0.14.16668 > 36.24.146.114.64853: Flags [S.], cksum 0xdc0f (correct), seq 3029391223, ack 129060479, win 14480, options [mss 1460,sackOK,TS val 1254469916 ecr 1492278057,nop,wscale 6], length 0
        0x0000:  feee 809f 3247 5254 0054 aa9f 0800 4500  ....2GRT.T....E.
        0x0010:  003c 0000 4000 4006 d813 ac10 000e 2418  .<..@.@.......$.
        0x0020:  9272 411c fd55 b490 d777 07b1 4e7f a012  .rA..U...w..N...
        0x0030:  3890 dc0f 0000 0204 05b4 0402 080a 4ac5  8.............J.

uname -a
# Linux VM_0_14_centos 2.6.32-754.2.1.el6.x86_64 #1 SMP Fri Jul 13 12:50:12 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

# tcpdump
tcpdump tcp -vv -XX -n -i eth0 port 16668

Upvotes: 0

Views: 149

Answers (1)

Steffen Ullrich
Steffen Ullrich

Reputation: 123270

    0x0000:  feee 809f 3247 5254 0054 aa9f 0800 4500  ....2GRT.T....E.

The first 14 bytes are from the link layer (EN10MB). The IP layer only starts with 4500, where the 4 (binary 0100) are the first 4 bits which describe the version number, i.e. IP version 4.

These link layer data are explicitly requested by the -XX option which is used by the OP as pointed out in a comment by David Hoelzer. To cite from the documentation of tcpdump:

-XX    When parsing and printing, in addition to printing the headers of each packet, print the data of each packet, including its link level header, in hex and ASCII.

Upvotes: 2

Related Questions