Re: Re: NetPacket::TCP output

[Benedict]

in reply to Re: NetPacket::TCP output
in thread NetPacket::TCP output

Ah, I'm fairly familiar with the flags and what they mean, ACK, SYN, RST, etc. My problem is that the output from NetPacket::TCP for the flags does not seem to be in the form, ACK, etc., but is somekind of numerical encoding. For instance, to test what the output was like, I captured one packet and printed out the flags, and what I got was "24". I don't know how to interpret that.

Benedict

[Benedict]

There are six flags. Perhaps 2, for instance, is SYN, and 4 is ACK?

Benedict

[Anonymous Monk]

Nope, that explanation doesn't work. Help?

Benedict

[jlargent]

I can't take credit for this, I copied from someone elses code.

sub parse_tcp_flags {
   my $flagword = shift(@_);
   my %flags = ("FIN"=>0,"SYN"=>0,"RST"=>0,"PSH"=>0,"ACK"=>0,"URG"=>0)
+;
   $flags{FIN} = ($flagword & 0x01)? 1: 0;
   $flags{SYN} = ($flagword & 0x02)? 1: 0;
   $flags{RST} = ($flagword & 0x04)? 1: 0;
   $flags{PSH} = ($flagword & 0x08)? 1: 0;
   $flags{ACK} = ($flagword & 0x10)? 1: 0;
   $flags{URG} = ($flagword & 0x20)? 1: 0;
   return \%flags;
}

Pass this function the flags from parse_tcp_flags