The TCP Header Offsets


Now let's say we're looking for a particular value in the TCP header - perhaps you are focusing in on a particular application that uses port 1214 by default. If you want to capture all traffic sent to this port number, you'll need to filter on this value at the correct offset.

Figure 8 shows the offsets for the TCP header. Again, we are defining the offsets based on the protocol offset value, not the packet offset value.

click to expand
Figure 8: The TCP header is much more complex than the Ethernet or IP header. Whee!

You'll want to build a bunch o' filters based on the TCP header - the following provides a quick listing to start with:

Protocol Offset

Value (in hexadecimal)

0x16/22d (Destination Port field)

0x04BE (1214 decimal) Morpheus

0x14/20d (Source Port field)

0x04BE (1214 decimal) Morpheus

0x16/22d (Destination Port field)

0x18CA (6346 decimal) Gnutella

0x14/20d (Source Port field)

0x18CA (6346 decimal) Gnutella

0x16/22d (Destination Port field)

0x18CB (6347 decimal) Gnutella

0x14/20d (Source Port field)

0x18CB (6347 decimal) Gnutella

0x22/34d (Window Size field)

0x0000 - Window size of 0

Some of the more interesting filters are built based on the flags in the TCP header. The flags are shown in Figure 8 listed by their initials:

Initial

Flag

U

Urgent(look in the Urgent Pointer field next)

A

Acknowledge (got that last data, thanks!)

P

Push (this is important; don't buffer it)

R

Reset (I don't know what you're saying; the port is closed)

S

Synchronize (let's connect; here's my sequence number)

F

Finish (I'm done; let's close the connection)

Note 

If you don't feel 'warm and fuzzy' with the TCP flags, go order "Guide to TCP/IP" that I wrote with Ed Tittel. This book provides a packet-level view of TCP/IP communications. You can order the book through podbooks.com or any bookstore. The ISBN number is 0-619035-30-7. -- Laura

I'm going to get down and dirty into the TCP header fields in Chapter 4, "Pattern Filters," - awesome stuff!




Packet Filtering. Catching the Cool Packets.
Packet Filtering: Catching the Cool Packets
ISBN: 1893939383
EAN: 2147483647
Year: 2000
Pages: 65

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net