Re: NetPacket::TCP output

[chromatic]

in reply to NetPacket::TCP output

The first place I found searching Google was RFC 793. You'll probably have better luck reading something like TCP Illustrated by W. Richard Stevens.

They're standard flags, though, so there has to be plenty of material on the Net somewhere. If you can find documentation of the TCP protocol or a TCP FAQ, it'll give you a better idea. (My concept is fuzzy. I can't name them, but I can more or less recognize them.)

[Benedict]

Ah, I'm fairly familiar with the flags and what they mean, ACK, SYN, RST, etc. My problem is that the output from NetPacket::TCP for the flags does not seem to be in the form, ACK, etc., but is somekind of numerical encoding. For instance, to test what the output was like, I captured one packet and printed out the flags, and what I got was "24". I don't know how to interpret that.

Benedict

[Benedict]

There are six flags. Perhaps 2, for instance, is SYN, and 4 is ACK?

Benedict

[Anonymous Monk]

Nope, that explanation doesn't work. Help?

Benedict

[Anonymous Monk]

It appears to be as follows.

1 = FIN
2 = SYN
4 = RST
8 = PSH
16 = ACK
32 = URG

What ever number is returned from the $tcp->{'flags'} represents what packet set was seen. Ex: SYN ACK = 2 + 16 resulting in 18.