CODEWITHSUNDEEP
gosocketsnetwork-programmingwiresharkicmp
Commander_Rex
Commander_Rex

Reputation: 31

Different Datagram Length Field In IP Headers

I am trying to parse a ICMP packet starting with the IP header.

func main() {
    fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_RAW, syscall.IPPROTO_ICMP)
    if err != nil {
        fmt.Println(err)
        return
    }

    for {
        buf := make([]byte, 1024)
        numRead, err := syscall.Read(fd, buf)
        if err != nil {
            fmt.Println(err)
        }

        fmt.Println(hex.EncodeToString(buf[:numRead]))

    }
}

This is my starting Go code.

  1. I run this application
  2. I run Wireshark to listen ICMP packets. Filter: ip.src==192.168.1.109||ip.dst==192.168.1.109
  3. I ping to google.com to capture the echo reply.

I was expecting to reply packets from the Wireshark and my application to be the same but results are like this:

Note: Bytes is starting from IP Header I did not give the Link Layer bytes.

Go: 45004000000000003801c12cd8ef2678c0a8016d00007e72324f0000668e33570008ca4d08090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637

Wireshark: 45000054000000003801c12cd8ef2678c0a8016d00007e72324f0000668e33570008ca4d08090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637

If we look at the first 20 bytes of the IP Header the only difference is the datagram length. Starting from the 3. byte to the 4. byte.

Go: 4000

Wireshark: 0054

I could not find that why they are different since I am listenning on the same datagram with the same sequence number. Thanks for your time.

Upvotes: 1

Views: 36

Answers (1)

Commander_Rex
Commander_Rex

Reputation: 31

It turns out macOS is changing the raw socket header when it arrives. Wireshark can show the true result since it was working on a kernel level. When I run a fedora docker container and run the script it gives the same result as in the Wireshark.

Upvotes: 1

Related Questions