Here is were I store all info:

struct tcpinfo {
..
tcp_seq ti_ack;			/* Acknowledge number. */

};

struct packet {
..
union p_specifics {
struct tcpinfo s_tcp;
struct udpinfo s_udp;
} spec;
};


I print it with this:

printf(", win %u, ack %u", p->tcp.ti_win, p->tcp.ti_ack);

And this is what kind of output I get:

21:27:24.264586 TCP 66.35.250.62:80 > 192.168.0.3:56131: 936 bytes, IP
flags DF, ttl 42, id 17983, TCP flags PUSH ACK, win 6432, ack -1495634489

21:27:24.264725 TCP 66.35.250.62:80 > 192.168.0.3:56131: 75 bytes, IP
flags DF, ttl 42, id 17984, TCP flags PUSH ACK, win 6432, ack -1495634489

21:27:24.264939 TCP 66.35.250.62:80 > 192.168.0.3:56131: 70 bytes, IP
flags DF, ttl 42, id 17985, TCP flags FIN ACK, win 6432, ack -1495634489

How come I am getting a negative number?

[ Post a follow-up to this message ]

chris wrote:
> Here is were I store all info:
>
> struct tcpinfo {
>     ...
>     tcp_seq ti_ack;            /* Acknowledge number. */
>
> };
>
> struct packet {
>     ...
>     union p_specifics {
>         struct tcpinfo s_tcp;
>         struct udpinfo s_udp;
>     } spec;
> };
>
>
> I print it with this:
>
> printf(", win %u, ack %u", p->tcp.ti_win, p->tcp.ti_ack);
>
> And this is what kind of output I get:
>
> 21:27:24.264586 TCP 66.35.250.62:80 > 192.168.0.3:56131: 936 bytes, IP
> flags DF, ttl 42, id 17983, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264725 TCP 66.35.250.62:80 > 192.168.0.3:56131: 75 bytes, IP
> flags DF, ttl 42, id 17984, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264939 TCP 66.35.250.62:80 > 192.168.0.3:56131: 70 bytes, IP
> flags DF, ttl 42, id 17985, TCP flags FIN ACK, win 6432, ack -1495634489
>
> How come I am getting a negative number?


you've forgotten to recompile your program?
otherwise, try to printf("%u", (tcp_seq)-1); to check whether your
standard C library behaves well.

--
Lev Walkin
vlm@lionet.info

[ Post a follow-up to this message ]

In article <ZUWFc.68521$Np3.3283209@ursa-nb00s0.nbnet.nb.ca>,
chris <chris@misery.net> wrote:

> Here is were I store all info:
>
> struct tcpinfo {
> 	...
> 	tcp_seq ti_ack;			/* Acknowledge number. */
>
> };
>
> struct packet {
> 	...
> 	union p_specifics {
> 		struct tcpinfo s_tcp;
> 		struct udpinfo s_udp;
> 	} spec;
> };
>
>
> I print it with this:
>
> printf(", win %u, ack %u", p->tcp.ti_win, p->tcp.ti_ack);

Shouldn't it be p->s_tcp.ti_win and p->s_tcp.ti_ack?  You haven't shown
the rest of the structure definition, so I don't know what p->tcp
contains.

>
> And this is what kind of output I get:
>
> 21:27:24.264586 TCP 66.35.250.62:80 > 192.168.0.3:56131: 936 bytes, IP
> flags DF, ttl 42, id 17983, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264725 TCP 66.35.250.62:80 > 192.168.0.3:56131: 75 bytes, IP
> flags DF, ttl 42, id 17984, TCP flags PUSH ACK, win 6432, ack -1495634489
>
> 21:27:24.264939 TCP 66.35.250.62:80 > 192.168.0.3:56131: 70 bytes, IP
> flags DF, ttl 42, id 17985, TCP flags FIN ACK, win 6432, ack -1495634489
>
> How come I am getting a negative number?

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

[ Post a follow-up to this message ]

Barry Margolin wrote:

> In article <ZUWFc.68521$Np3.3283209@ursa-nb00s0.nbnet.nb.ca>,
>  chris <chris@misery.net> wrote:
>
> 
>
>
> Shouldn't it be p->s_tcp.ti_win and p->s_tcp.ti_ack?  You haven't shown
> the rest of the structure definition, so I don't know what p->tcp
> contains.
>
> 
>
>

I used to #defines to mask the union inside struct packet, but Lev was
right (I didn't recompile); I must have been half asleep last night 

[ Post a follow-up to this message ]

In article <xXXFc.68553$Np3.3284542@ursa-nb00s0.nbnet.nb.ca>,
chris <chris@misery.net> writes:
>
> I used to #defines to mask the union inside struct packet, but Lev was
> right (I didn't recompile); I must have been half asleep last night 

OK, you found it, but another thing worth pointing out is that
if you are using a kernel based printf, they are often less
functional than you are accustomed to in the C library (although
I don't recall finding a kernel printf that didn't implement or
got %u wrong).  Wasn't clear if you are dabbling in kernel or not.

--
Andrew Gabriel
Consultant Software Engineer

[ Post a follow-up to this message ]

Andrew Gabriel wrote:
> In article <xXXFc.68553$Np3.3284542@ursa-nb00s0.nbnet.nb.ca>,
> 	chris <chris@misery.net> writes:
> 
>
>
> OK, you found it, but another thing worth pointing out is that
> if you are using a kernel based printf, they are often less
> functional than you are accustomed to in the C library (although
> I don't recall finding a kernel printf that didn't implement or
> got %u wrong).  Wasn't clear if you are dabbling in kernel or not.
>

Nah this is just a simple (less functional) tcpdump clone. Thanks though.

[ Post a follow-up to this message ]