Source ports at the IP layer

Source ports at the IP layer

[Javier Govea]

Hi guys,

I want to get the source ports of every incomming IP packet at the IP layer, but I'm
having problems. 

A print out, in the ip_rcv() function (in ip_input.c), of skb->h.uh->source (for the UDP
source port) and of skb->h.th->source (for the TCP source port) is always displaying 17664
(and i'm sure that is not the real source port). What am i doing wrong?? Is it possilble
at all to get the source ports directly from skb->h.th->source at this early stage, i mean
at the IP layer?? Do i need to do some casting or calling another function before i can
get the ports??? 

I also tried  
struct tcphdr *th = (struct tcphdf *)skb->h.th;
and then printing out th->source...but i'm still getting 17664...any suggestion on how I
can get the ports??? All ideas are very very welcome...

Thanx in advance...
Xavier

Re: Source ports at the IP layer

[Willy Tarreau]

 
> I also tried  
> struct tcphdr *th = (struct tcphdf *)skb->h.th;
> and then printing out th->source...but i'm still getting 17664...any suggestion on how I
> can get the ports??? All ideas are very very welcome...

I think you forgot to add the IP header length somewhere, because 17664 is
0x4500 = the start of your IP header, and not the TCP header.

Cheers,
Willy

Re: Source ports at the IP layer

[Raj]

> > I also tried
> > struct tcphdr *th = (struct tcphdf *)skb->h.th;
> > and then printing out th->source...but i'm still getting 17664...any suggestion on how I
> > can get the ports??? All ideas are very very welcome...

A weird wild guess :-) . Possibly the source port is still in
network-byte-order. Try converting it to host-byte-order ( if your
machine arch is little-endian ) before printing. 

Network-byte-order 17664 = 69 in little-endian which is tftp.

/Raj