Parse ethernet, IP and TCP headers

Question

I would like to understand how it's possible to iterate over a packet collected with pcap.

#include <pcap.h>
#include <netinet/if_ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>

void analyse(struct pcap_pkthdr *header, const unsigned char *packet, int verbose) {

    /** Ethernet header has a fixed value, IP header and TCP header don't **/
    ip_size = sizeof( struct ip );
    tcp_size = sizeof( struct tcphdr );

    /* Assign each pointer its correct value **/
    const struct ether_header *ethernet = ( struct ether_header* ) packet;
    const struct ip *ip = (struct ip*) ( packet + ETH_HLEN );
    const struct tcp *tcp = (struct tcphdr*) (packet + ETH_HLEN + ip_size );
    const char *payload = ( packet + ETH_HLEN + ip_size + tcp_size );

}

Can I be sure that the ethernet, ip, tcp,payload`respectively point to:

• First bit of the Data link Layer (Ethernet header)
• First bit of the Network Layer (IP header)
• First bit of the Transport Layer (TCP header)
• First bit of the payload

Thanks,

Answer 1

No, you cannot. I assume you are talking about the first version of the PCAP standard. There is another one called pcap-ng (next generation).

https://www.ietf.org/staging/draft-tuexen-opsawg-pcapng-02.html

• File header

On the start of PCAP file there is a fixed size header. The last field in that header is the data link type.

https://tools.ietf.org/id/draft-gharris-opsawg-pcap-00.html

Hopefully the link type LINKTYPE_ETHERNET value is 0x1. If it is not, you can basically throw away the entire file.

https://www.tcpdump.org/linktypes.html

• Ethernet header

So now we know that every packet in the file will the of the type ethernet. You skip the ethernet header just adding sizeof(ethhdr).

After the ethernet header the IP header might not be the next layer. You have to process the protocols as they show up in the chain.

For example, VLAN headers are placed right after the ethernet header, sometimes multiple VLAN headers in chain so you have to skip all them. This would be indicated by ethernet->h_proto==ETH_P_8021Q.

VLAN is one of them. There are other protocols and that's where it gets really complex to write something very generic to parse all them.

In 99.9% of the cases you can assume the ethernet header plus the potentially multiple VLAN headers but you have to skip each of them in sequence until ethernet->h_proto==ETH_P_IP or an unknown protocol is found, in which case you bail out.

• IP Headers

If it is IPv4, skip the standard IP header and then the IP options. The IP header has variable size, although most of the time it is fixed. This is due to the options part of the IP header. What you see in the struct iphdr is only the fixed part.

You have to account for skipping the options part too so you have to add (ip->ihl & 0xF) * 4 and which will be typically equal to sizeof(iphdr) if ip->ihl&0xF is 5, which is almost always the case.

• TCP header

The TCP header also contains options but in the fixed part of the header you have a count of how many 32-bit blocks the entire TCP header has. Just skip the entire header by adding tcp->th_off*4.

5 years later this is responded.