How would I go about calculating the size and starting byte of the data in a TCP packet (excluding the header information)?
I am going to assume that you are dealing with a TCP/IP packet. You will need to calculate this size yourself.
The IP header has a 'Total Length' field that gives you the length of the entire IP packet in bytes. If you subtract the number of 32-bit words that make up the header (given by the Header Length field in the IP header) you will know the size of the TCP packet. Usually, the header is 20 bytes for the IP packet, unless Options are present.
In the TCP header, the Data Offset field specifies the size of the TCP header in 32-bit words. Again, you can subtract the number (multiplied with 4 to give you the number of bytes in the header) from the size of the TCP packet you calculated earlier to get you the size of the data in the TCP packet.
Given the Header Length in the IP header and the Data Offset in the TCP header, you can add those two and multiply by 4 to give you the byte offset till the data in the TCP packet starts.
I just captured a TCP packet on my router, then I calculated the TCP data length.
IHL = 5
Total Length = 0x00a8
Data Offset = 8
---------------------
0x00a8 - (5 + 8) * 4 = 116 bytes
# tcpdump -n -i br-lan -c 1 -e -XX tcp port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br-lan, link-type EN10MB (Ethernet), capture size 65535 bytes
15:33:53.917593 ae:ca:87:aa:aa:aa > b8:e8:56:bb:bb:bb, ethertype IPv4 (0x0800), length 182: 192.168.31.1.22 > 192.168.31.102.54076: Flags [P.], seq 582717816:582717932, ack 442380252, win 4706, options [nop,nop,TS val 100656432 ecr 1139948861], length 116
0x0000: b8e8 56bb bbbb aeca 87aa aaaa 0800 4510 ..V........x..E.
^
0x0010: 00a8 8d0c 4000 4006 ed7b c0a8 1f01 c0a8 ....#.#..{......
^^^^
0x0020: 1f66 0016 d33c 22bb 9178 1a5e 2fdc 8018 .f...<"..x.^/...
^
0x0030: 1262 c052 0000 0101 080a 05ff e530 43f2 .b.R.........0C.
0x0040: 3d3d f6e4 f672 736f 6c6c 191f 64ec 80a6 ==...rsoll..d...
0x0050: ba74 e8f7 b2ce 99ec 2725 2d49 f4f6 7760 .t......'%-I..w`
0x0060: c83f 5130 83bb ca22 c32c 6251 7381 08e2 .?Q0...".,bQs...
0x0070: c036 1c12 f22f fe8b c36a eeff c95c 36fa .6.../...j...\6.
0x0080: 7baa 810b 4c75 8ccf 19e4 62df 2c2c c5fd {...Lu....b.,,..
0x0090: a0c8 aa53 1130 d413 7097 f1cd 34dc 92b7 ...S.0..p...4...
0x00a0: ea9b 3bd6 02f8 ea93 c8f3 7d32 4a58 39aa ..;.......}2JX9.
0x00b0: 12d3 e2bd 18d4 ......
Entire ethernet frame
IP header (IHL / Total Length)
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|**IHL**|Type of Service|**********Total Length*********|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding | <-- optional
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| DATA ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
TCP header (Data Offset)
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |C|E|U|A|P|R|S|F| |
| Offset| Res. |W|C|R|C|S|S|Y|I| Window |
| ******| |R|E|G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Related
stream table
experiment
protocol
test
stream_size
metric
value
1
tcp
stream
64
throughput Gbps
10
1
tcp
stream
64
cpu utilization
.5
2
tcp
stream
64
throughput Gbps
40
2
tcp
stream
64
cpu utilization
.9
3
udp
stream
64
throughput Gbps
20
3
udp
stream
64
cpu utilization
.5
4
udp
stream
64
throughput Gbps
60
4
udp
stream
64
cpu utilization
.8
rr table
experiment
protocol
test
request_size
response_size
metric
value
5
tcp
request and response
64
64
transactions per second
10
5
tcp
request and response
64
64
cpu utilization
.6
6
tcp
request and response
64
1024
transactions per second
8
6
tcp
request and response
64
1024
cpu utilization
.5
7
udp
request and response
64
64
transactions per second
30
7
udp
request and response
64
64
cpu utilization
.4
8
udp
request and response
64
1024
transactions per second
29
8
udp
request and response
64
64
cpu utilization
.75
As of now, the outcomes for the experiments are the listed in the metric column, and their value is in the value column.
I know that I can drop the test specific columns like stream_size, request_size, and response_size, and then bind the rows to make one data frame.
Using R and tidyverse tools, how would you go about combining the two data frames into a long format, so that the combined data frame does not have the test specific columns, stream_size, request_size, and response_size?
Is there a better or more succinct way to make the schema for these experiments' data to facilitate combining the data frames?
You could bind the 2 dataframes together, then pivot just the columns that end with size to long form.
library(tidyverse)
bind_rows(stream, rr) %>%
pivot_longer(ends_with("size"), names_to = "test_specific", values_to = "size", values_drop_na = TRUE)
Output
experiment protocol test metric value test_specific size
<int> <chr> <chr> <chr> <dbl> <chr> <int>
1 1 tcp stream throughput Gbps 10 stream_size 64
2 1 tcp stream cpu utilization 0.5 stream_size 64
3 2 tcp stream throughput Gbps 40 stream_size 64
4 2 tcp stream cpu utilization 0.9 stream_size 64
5 3 udp stream throughput Gbps 20 stream_size 64
6 3 udp stream cpu utilization 0.5 stream_size 64
7 4 udp stream throughput Gbps 60 stream_size 64
8 4 udp stream cpu utilization 0.8 stream_size 64
9 5 tcp request and response transactions per second 10 request_size 64
10 5 tcp request and response transactions per second 10 response_size 64
# … with 14 more rows
Can anyone guide me on the following?
I'm trying to figure out the answer as seen in the first question inside the blog malwarejake[.]blogspot.com/2015/05/packet-analysis-practice-part-3.html .
As per sample packet found
What is the embedded protocol, the destination port, and the amount of data not including protocol headers?
0x0000: 4500 004c 1986 4000 4006 9cba c0a8 0165
0x0010: c0a8 01b6 0015 bf3c dad0 5039 2a8c 25be
0x0020: 8018 0072 06ec 0000 0101 080a 008a 70ac
The answer for the above question is as above.
Embedded protocol: TCP
Total packet length: 76
IP Header length: 20
Protocol header length: 32
Data length: 24
Dest Port: 0xbf3c (48956)
I managed to get all the other answer with the exception of Protocol Header Length and Data Length.
Isn't TCP Header Length normally 20 bytes with the extension up to 40 bytes? But how is 32 bytes derived from the above packet? I don't understand.
Thanks!
Here's the TCP Header directly from the RFC:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |U|A|P|R|S|F| |
| Offset| Reserved |R|C|S|S|Y|I| Window |
| | |G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The values 0015 and bf3c are the ports.
The values dad0 5039 and 2a8c 25be are the sequence/ack numbers.
Now take a look at the next 4 bits. The ones at offset 0x20. The value of the byte is 0x80, which means that the topmost 4 bits are 1000. They correspond to the "data offset" field:
Data Offset: 4 bits
The number of 32 bit words in the TCP Header. This indicates where
the data begins. The TCP header (even one including options) is an
integral number of 32 bits long.
So 1000 means that the header consists of 8 x 32-bit words, which means 8 x 4 bytes = 32 bytes.
I'm studying for my cisco CCENT and I'm having a real hard time understanding wildcard masking this video was pretty straight forward and simple:
Wildcard Mask Video
However when applied to this question it yields the wrong answer:
You need to create a wildcard mask for the entire Class B private IPv4 address space
172.16.0.0/16 through 172.31.0.0/16. What is the wildcard mask?
One is tempted based upon the video to answer 0.0.255.255 however this is the incorrect answer with the correct answer being 0.15.255.255???
No matter how much I tinker with the bits to try and make sense of it I feel I am missing something can someone explain?
It occurs to me they could be super strict and only want the wildcard mask for the given range but in which case I would answer 2^5 for 32 = 255.248.0.0 = WCM 0.7.255.255 but alas this was not the answer either not even close what am I missing?
Here is another similar question...
Which address and wildcard mask combination will match all IPv4 addresses in the networks
192.168.0.0/24 through 192.168.63.0/24?
What I wanted to say: 192.168.0.0 0.0.0.255
Answer: 192.168.0.0 0.0.63.255
Create an IP Slide Rule with the mask on the first row and the bit values on the second row.
Mask 128 192 224 240 248 252 254 255
128 64 32 16 8 4 2 1
Now you need to convert the IP address to binary
I hope my paste doesn't go funky. Here are the examples
Mask 128 192 224 240 248 252 254 255
128 64 32 16 8 4 2 1
192.168.0 0 0 0 0 0 0 0.00000000
192.168.0 0 1 1 1 1 1 1.00000000 x.x=192.168 since they are the same
Now you need to find from the IP slide rule the last bit where they are identical.
In this case it is the 64 and the mask for 64 is 192. Now you will subtract the new mask from 255
255 255 255 255
255 255 192 0 =
0. 0. 63.255 Wildcard mask is 0.0.63.255 answer is 192.168.0.0 0.0.63.255
You need to create a wildcard mask for the entire Class B private IPv4 address space
172.16.0.0/16 through 172.31.0.0/16. What is the wildcard mask?
Answer 0.15.255.255
Mask 128 192 224 240 248 252 254 255
128 64 32 16 8 4 2 1
172. 0 0 0 1 0 0 0 0 0.0
172. 0 0 0 1 1 1 1 1 0.0
Now you need to find in the ip slide rule the last bit where they are identical.
In this case it is the 16 and the mask for 16 is 240. Now you will subtract the new mask from 255
255 255 255 255
255 240 0 0
0. 15.255.255 Wildcard mask is 0.15.255.255 answer is 172.0.0.0 0.15.255.255
Results of the wildcard mask calculation provide the first IP address and last IP address in the wildcard mask network range.
If it was only 192.168.0.0 /24 your output would be 0.0.0.255 but your question is combination of 192.168.0.0/24 through 192.168.63.0/24 so you must calculate it.
This is a piece of /proc/net/tcp file:
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
6: 1904A8C0:AC35 9603020A:1ED0 01 00000000:00000000 00:00000000 00000000 10055 0 8506 2 c1624900 129 0 0 10 -1
7: 1904A8C0:E8C4 13A11C1F:0050 06 00000000:00000000 03:00001390
00000000 0 0 0 3 d6267780
Can anyone explain me what do values mean in the inode column? I`m intrested in two cases.
8506 2 c1624900 129 0 0 10 -1
0 3 d6267780
I only know first value is inode number (unique file number).
linux-2.6.35.6/net/ipv4/tcp_ipv4.c
2358 seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
2359 "%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
2360 i, src, srcp, dest, destp, sk->sk_state,
2361 tp->write_seq - tp->snd_una,
2362 rx_queue,
2363 timer_active,
2364 jiffies_to_clock_t(timer_expires - jiffies),
2365 icsk->icsk_retransmits,
2366 sock_i_uid(sk),
2367 icsk->icsk_probes_out,
2368 sock_i_ino(sk),
2369 atomic_read(&sk->sk_refcnt), sk,
2370 jiffies_to_clock_t(icsk->icsk_rto),
2371 jiffies_to_clock_t(icsk->icsk_ack.ato),
2372 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
2373 tp->snd_cwnd,
2374 tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh,
2375 len);
3 ppl (A B C) are connected to a local server (S1) through SSH (putty, or Unix console), with the same username (foobar). Is there a way to associate their own IP to the pts they create ?
For example, a command witch display that :
S1:/root# ls -l /dev/pts
crw------- 1 foobar tty 136, 0 16 apr 10:34 0 <-> 192.168.0.A
crw------- 1 foobar tty 136, 2 16 apr 10:22 2 <-> 192.168.0.B
crw------- 1 foobar tty 136, 3 16 apr 09:26 3 <-> 192.168.0.A
crw------- 1 foobar tty 136, 5 16 apr 09:26 5 <-> 192.168.0.C
Thanks !
"who" command shows you the association between pts-s and hostnames (or ip-s if there is no hostname). You can change the hostnames to IP using 'host' command (if this is a requirement for you).