Date: Tue, 8 Sep 1998 17:10:10 -0400 (EDT)
From: Jeff DeFouw <[email protected]>
On Tue, 8 Sep 1998, David S. Miller wrote:
> But if you provide more dumps to help me debug this problem could
> you please rebuild tcpdump with the patch I have appended at the end?
> The stock tcpdump does not output SACK information from TCP packets
> properly without the patch. The stock tcpdump uses the pre-RFC format
> of the SACKS which is nothing like real modern SACKs in use today :-)
Did you forget to append the patch, or is there somewhere I can get it?
Sorry, here it is:
--- tcpdump-3.3/tcpdump-3.3/print-tcp.c.orig Tue Dec 10 23:26:08 1996
+++ tcpdump-3.3/tcpdump-3.3/print-tcp.c Thu Mar 19 23:46:33 1998
@@ -103,8 +103,8 @@
register int hlen;
register char ch;
u_short sport, dport, win, urp;
- u_int32_t seq, ack;
-
+ u_int32_t seq, ack,thseq,thack;
+ int threv;
tp = (struct tcphdr *)bp;
ip = (struct ip *)bp2;
ch = '\0';
@@ -162,7 +162,7 @@
tha.port = dport << 16 | sport;
rev = 1;
}
-
+ threv = rev;
for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
th->nxt; th = th->nxt)
if (!memcmp((char *)&tha, (char *)&th->addr,
@@ -183,6 +183,10 @@
else
th->seq = seq, th->ack = ack - 1;
} else {
+
+ thseq = th->seq;
+ thack = th->ack;
+
if (rev)
seq -= th->ack, ack -= th->seq;
else
@@ -263,18 +267,32 @@
break;
case TCPOPT_SACK:
- (void)printf("sack");
- datalen = len - 2;
- for (i = 0; i < datalen; i += 4) {
- LENCHECK(i + 4);
- /* block-size@relative-origin */
- (void)printf(" %u@%u",
- EXTRACT_16BITS(cp + i + 2),
- EXTRACT_16BITS(cp + i));
+ {
+ u_int32_t s, e;
+
+ datalen = len - 2;
+ if (datalen % 8 != 0) {
+ (void)printf(" malformed sack ");
+ } else {
+ (void)printf(" sack %d ", datalen / 8);
+ for (i = 0; i < datalen; i += 8) {
+ LENCHECK(i + 4);
+ s = EXTRACT_32BITS(cp + i);
+ LENCHECK(i + 8);
+ e = EXTRACT_32BITS(cp + i + 4);
+ if (threv) {
+ s -= thseq;
+ e -= thseq;
+ } else {
+ s -= thack;
+ e -= thack;
+ }
+ (void)printf("{%u:%u}", s, e);
}
- if (datalen % 4)
- (void)printf("[len %d]", len);
- break;
+ (void)printf(" ");
+ }
+ break;
+ }
case TCPOPT_ECHO:
(void)printf("echo");