<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
<BR>Ok, I found my mistake, I don't know why but I'm thinking that udp packets had 80 port too, I check my tcp ports and they are correct, <FONT color=#333333>sorry for bothering you.</FONT><BR>
<FONT color=#333333></FONT> <BR>
<FONT color=#333333>And one question, could it be to have the same port, source and destination for a udp packets? </FONT><FONT color=#333333><BR></FONT>
<BLOCKQUOTE>
<HR>
From: essence_z@hotmail.com<BR>To: winpcap-users@winpcap.org<BR>Date: Wed, 19 Mar 2008 13:56:10 +0100<BR>Subject: [Winpcap-users] it doesn't show the correct ports<BR><BR>
<META content="Microsoft SafeHTML" name=Generator>
<STYLE>
.ExternalClass .EC_hmmessage P
{padding:0px;}
.ExternalClass body.EC_hmmessage
{font-size:10pt;font-family:Tahoma;}
</STYLE>
Hello, I can't explain why in this code when I output source and destination udp port, it show me port: 1042 and 53, it should be 80 instead of 53. and no always show the same port 1042.<BR> <BR>Porgramming in builder c++<BR> <BR>..<BR>int cont = 0;<BR>int res = pcap_next_ex(adhandle_, &header, &pkt_data);<BR> if (res == 0) //Timeout elapsed<BR> continue;<BR> cont++;<BR> cadenaIDx = AnsiString (cont); //show the index<BR> //Tiempo<BR> local_tv_sec = header->ts.tv_sec;<BR> ltime = localtime(&local_tv_sec);<BR> strftime(timestr, sizeof timestr, "%H:%M:%S", ltime);<BR> cadenaTIm = AnsiString(timestr) + "." + header->ts.tv_usec; //show the time<BR> ether_header *ether;<BR> ether = (ether_header*)(pkt_data);<BR> switch(htons(ether->h_type))<BR> {<BR> case 0x0800: //IPv4<BR> ip_header *ip;<BR> udp_header *udp;<BR> u_int ip_len;<BR> ip = (ip_header*)(pkt_data + 14);<BR> sprintf(macaddr1,"%d.%d.%d.%d",ip->saddr.byte1,<BR> ip->saddr.byte2,ip->saddr.byte3,ip->saddr.byte4);<BR> sprintf(macaddr2,"%d.%d.%d.%d",ip->daddr.byte1,<BR> ip->daddr.byte2,ip>daddr.byte3,ip>daddr.byte4); <BR> cadenaIPs = macaddr1; //show IP source address<BR> cadenaIPd = macaddr2; //show IP dest address<BR><BR> <BR> switch (ip->proto)<BR> {<BR> case 1:<BR> cadenaPRt = "ICMP";<BR> break;<BR> case 2:<BR> cadenaPRt = "IGMP";<BR> break;<BR> case 4:<BR> cadenaPRt = "IP";<BR> break;<BR><BR> case 6:<BR> cadenaPRt = "TCP";<BR> break;<BR> case 17:<BR> cadenaPRt = "UDP"; //show protocol<BR> ip_len = (ip->ver_ihl & 0xf) * 4; //Longitud de Ip header<BR> udp = (udp_header*)((u_char*)ip + ip_len);<BR> //udp = (udp_header*)(pkt_data+14+sizeof(ip_header));<BR> cadenaSPo = ntohs(udp->sport); //show udp source port<BR> cadenaDPo = ntohs(udp->dport); //show udp destination port<BR> break;<BR> default:<BR> cadenaPRt = "?";<BR> break;<BR> }<BR> break;<BR> case 0x0806:<BR> cadenaPRt = "ARP";<BR> arp_header *arp;<BR> arp = (arp_header*)(pkt_data + 14);<BR> sprintf(macaddr1,"%02X-%02X-%02X-%02X-%02X-%02X",arp->src_addr[0],<BR> arp->src_addr[1],arp->src_addr[2],arp->src_addr[3],arp->src_addr[4],<BR> arp->src_addr[5]);<BR> sprintf(macaddr2,"%02X-%02X-%02X-%02X-%02X-%02X",arp->dst_addr[0],<BR> arp->dst_addr[1],arp->dst_addr[2],arp->dst_addr[3],arp->dst_addr[4],<BR> arp->dst_addr[5]);<BR> cadenaIPs = macaddr1;<BR> cadenaIPd = macaddr2;<BR> break;<BR> default:<BR> cadenaPRt = "otros";<BR> break;<BR> }<BR> <BR>the struct header that I use:<BR> <BR>/* Cabecera ARP */<BR>struct arp_header<BR>{<BR> u_short hardware;<BR> u_short protocol;<BR> u_char hw_addr_len;<BR> u_char proto_addr_len;<BR> u_short operation;<BR> u_char src_addr[6];<BR> u_char src_ip[4];<BR> u_char dst_addr[6];<BR> u_char dst_ip[4];<BR>};<BR>//4 bytes IP address<BR>struct ip_address<BR>{<BR> u_char byte1;<BR> u_char byte2;<BR> u_char byte3;<BR> u_char byte4;<BR>};<BR>// 20 bytes IP Header<BR>struct ip_header<BR>{<BR> u_char ver_ihl;<BR> u_char tos; // Type of service<BR> u_short tlen; // Total length<BR> u_short identification; // Identification<BR> u_short flags_fo; // Flags (3 bits) + Fragment offset (13 bits)<BR> u_char ttl; // Time to live<BR> u_char proto; // Protocol<BR> u_short crc; // Header checksum<BR> ip_address saddr; // Source address<BR> ip_address daddr; // Destination address<BR> // u_int op_pad; // Option + Padding -- NOT NEEDED!<BR>};<BR> <BR>struct udp_header<BR>{<BR> u_short sport; // Source port<BR> u_short dport; // Destination port<BR> u_short len; // Datagram length<BR> u_short crc; // Checksum<BR>};<BR><BR>
<HR>
Todo ruedas: información práctica y todo el glamour del mundo del motor. <A href="http://estilo.es.msn.com/" target=_blank>MSN Estilo y Tendencias</A> </BLOCKQUOTE><br /><hr />Tecnología, moda, motor, viajes,.suscríbete a nuestros boletines para estar siempre a la última <a href='http://newsletters.msn.com/hm/maintenanceeses.asp?L=ES&C=ES&P=WCMaintenance&Brand=WL&RU=http%3a%2f%2fmail.live.com' target='_new'>MSN Newsletters</a></body>
</html>