|
Home > Archive > Unix Programming > July 2004 > getting a negative TCP acknowledge number
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
getting a negative TCP acknowledge number
|
|
|
| Here is were I store all info:
struct tcpinfo {
...
tcp_seq ti_ack; /* Acknowledge number. */
};
struct packet {
...
union p_specifics {
struct tcpinfo s_tcp;
struct udpinfo s_udp;
} spec;
};
I print it with this:
printf(", win %u, ack %u", p->tcp.ti_win, p->tcp.ti_ack);
And this is what kind of output I get:
21:27:24.264586 TCP 66.35.250.62:80 > 192.168.0.3:56131: 936 bytes, IP
flags DF, ttl 42, id 17983, TCP flags PUSH ACK, win 6432, ack -1495634489
21:27:24.264725 TCP 66.35.250.62:80 > 192.168.0.3:56131: 75 bytes, IP
flags DF, ttl 42, id 17984, TCP flags PUSH ACK, win 6432, ack -1495634489
21:27:24.264939 TCP 66.35.250.62:80 > 192.168.0.3:56131: 70 bytes, IP
flags DF, ttl 42, id 17985, TCP flags FIN ACK, win 6432, ack -1495634489
How come I am getting a negative number?
| |
| Lev Walkin 2004-07-04, 5:52 pm |
| chris wrote:
> Here is were I store all info:
>
> struct tcpinfo {
> ...
> tcp_seq ti_ack; /* Acknowledge number. */
>
> };
>
> struct packet {
> ...
> union p_specifics {
> struct tcpinfo s_tcp;
> struct udpinfo s_udp;
> } spec;
> };
>
>
> I print it with this:
>
> printf(", win %u, ack %u", p->tcp.ti_win, p->tcp.ti_ack);
>
> And this is what kind of output I get:
>
> 21:27:24.264586 TCP 66.35.250.62:80 > 192.168.0.3:56131: 936 bytes, IP
> flags DF, ttl 42, id 17983, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264725 TCP 66.35.250.62:80 > 192.168.0.3:56131: 75 bytes, IP
> flags DF, ttl 42, id 17984, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264939 TCP 66.35.250.62:80 > 192.168.0.3:56131: 70 bytes, IP
> flags DF, ttl 42, id 17985, TCP flags FIN ACK, win 6432, ack -1495634489
>
> How come I am getting a negative number?
you've forgotten to recompile your program?
otherwise, try to printf("%u", (tcp_seq)-1); to check whether your
standard C library behaves well.
--
Lev Walkin
vlm@lionet.info
| |
| Barry Margolin 2004-07-04, 5:52 pm |
| In article <ZUWFc.68521$Np3.3283209@ursa-nb00s0.nbnet.nb.ca>,
chris <chris@misery.net> wrote:
> Here is were I store all info:
>
> struct tcpinfo {
> ...
> tcp_seq ti_ack; /* Acknowledge number. */
>
> };
>
> struct packet {
> ...
> union p_specifics {
> struct tcpinfo s_tcp;
> struct udpinfo s_udp;
> } spec;
> };
>
>
> I print it with this:
>
> printf(", win %u, ack %u", p->tcp.ti_win, p->tcp.ti_ack);
Shouldn't it be p->s_tcp.ti_win and p->s_tcp.ti_ack? You haven't shown
the rest of the structure definition, so I don't know what p->tcp
contains.
>
> And this is what kind of output I get:
>
> 21:27:24.264586 TCP 66.35.250.62:80 > 192.168.0.3:56131: 936 bytes, IP
> flags DF, ttl 42, id 17983, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264725 TCP 66.35.250.62:80 > 192.168.0.3:56131: 75 bytes, IP
> flags DF, ttl 42, id 17984, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264939 TCP 66.35.250.62:80 > 192.168.0.3:56131: 70 bytes, IP
> flags DF, ttl 42, id 17985, TCP flags FIN ACK, win 6432, ack -1495634489
>
> How come I am getting a negative number?
--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
| |
|
| Barry Margolin wrote:
> In article <ZUWFc.68521$Np3.3283209@ursa-nb00s0.nbnet.nb.ca>,
> chris <chris@misery.net> wrote:
>
>
>
>
> Shouldn't it be p->s_tcp.ti_win and p->s_tcp.ti_ack? You haven't shown
> the rest of the structure definition, so I don't know what p->tcp
> contains.
>
>
>
>
I used to #defines to mask the union inside struct packet, but Lev was
right (I didn't recompile); I must have been half asleep last night 
| |
| Andrew Gabriel 2004-07-04, 5:52 pm |
| In article <xXXFc.68553$Np3.3284542@ursa-nb00s0.nbnet.nb.ca>,
chris <chris@misery.net> writes:
>
> I used to #defines to mask the union inside struct packet, but Lev was
> right (I didn't recompile); I must have been half asleep last night
OK, you found it, but another thing worth pointing out is that
if you are using a kernel based printf, they are often less
functional than you are accustomed to in the C library (although
I don't recall finding a kernel printf that didn't implement or
got %u wrong). Wasn't clear if you are dabbling in kernel or not.
--
Andrew Gabriel
Consultant Software Engineer
| |
|
| Andrew Gabriel wrote:
> In article <xXXFc.68553$Np3.3284542@ursa-nb00s0.nbnet.nb.ca>,
> chris <chris@misery.net> writes:
>
>
>
> OK, you found it, but another thing worth pointing out is that
> if you are using a kernel based printf, they are often less
> functional than you are accustomed to in the C library (although
> I don't recall finding a kernel printf that didn't implement or
> got %u wrong). Wasn't clear if you are dabbling in kernel or not.
>
Nah this is just a simple (less functional) tcpdump clone. Thanks though.
|
|
|
|
|