Benedict has asked for the wisdom of the Perl Monks concerning the following question:

I'm using NetPacket::TCP to decode TCP headers. I'm getting the flags like so: 

$flags = $tcp_obj->{flags};

[download]

My problem is that I don't uderstand the format of the output. I tried to RTFM, but I couldn't find anything.

Thanks.

Benedict

Replies are listed 'Best First'.
Re: NetPacket::TCP output
by chromatic (Archbishop) on Oct 06, 2001 at 08:12 UTC
    The first place I found searching Google was RFC 793. You'll probably have better luck reading something like TCP Illustrated by W. Richard Stevens.

    They're standard flags, though, so there has to be plenty of material on the Net somewhere. If you can find documentation of the TCP protocol or a TCP FAQ, it'll give you a better idea. (My concept is fuzzy. I can't name them, but I can more or less recognize them.)

[reply]

      Ah, I'm fairly familiar with the flags and what they mean, ACK, SYN, RST, etc. My problem is that the output from NetPacket::TCP for the flags does not seem to be in the form, ACK, etc., but is somekind of numerical encoding. For instance, to test what the output was like, I captured one packet and printed out the flags, and what I got was "24". I don't know how to interpret that.

      Benedict

[reply]

        There are six flags. Perhaps 2, for instance, is SYN, and 4 is ACK?

        Benedict

[reply]
      It appears to be as follows. 
      1 = FIN
2 = SYN
4 = RST
8 = PSH
16 = ACK
32 = URG

      [download]
      What ever number is returned from the $tcp->{'flags'} represents what packet set was seen. Ex: SYN ACK = 2 + 16 resulting in 18.
[reply]
[d/l]

Back to Seekers of Perl Wisdom