Captured on Debian Wheezy with the following versions:
tcpdump version 4.3.0
libpcap version 1.3.0
Linux hibbing-nms 3.8.2 #1 SMP Wed Mar 6 10:26:51 CST 2013 x86_64 GNU/Linux
Here is an example packet showing the error. It describes the tcp header as
having a length of 0, but the data at 0x0032 (8002) states there should be a length
of 32 bytes (8*32/8=32)
WireShark shows a correct header length with a pcap of the same packet data.
Captured using "tcpdump -SXXAnetttvvv -s0 -i bond0"
2013-04-06 09:06:27.414516 00:1a:a0:c2:e0:42 > 68:ef:bd:ea:a6:c0, ethertype 802.1Q (0x8100), length 70: vlan 255, p 0, ethertype IPv4, (tos 0x0, ttl 128, id 880, offset 0, flags [DF], proto TCP (6), length 52)
10.14.237.192.51130 > 10.3.237.8.8192: Flags [S], cksum 0x82bc (correct), seq 2434360485, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
0x0000: 68ef bdea a6c0 001a a0c2 e042 8100 00ff h..........B....
0x0010: 0800 4500 0034 0370 4000 8006 087a 0a0e ..E..4.p@....z..
0x0020: edc0 0a03 ed08 c7ba 2000 9119 64a5 0000 ............d...
0x0030: 0000 8002 2000 82bc 0000 0204 05b4 0103 ................
0x0040: 0308 0101 0402
I've also attached my analysis of the whole dump at:
http://www.pastebin.ca/2351377
Captured on Debian Wheezy with the following versions:
tcpdump version 4.3.0
libpcap version 1.3.0
Linux hibbing-nms 3.8.2 #1 SMP Wed Mar 6 10:26:51 CST 2013 x86_64 GNU/Linux
Here is an example packet showing the error. It describes the tcp header as
having a length of 0, but the data at 0x0032 (8002) states there should be a length
of 32 bytes (8*32/8=32)
WireShark shows a correct header length with a pcap of the same packet data.
Captured using "tcpdump -SXXAnetttvvv -s0 -i bond0"
2013-04-06 09:06:27.414516 00:1a:a0:c2:e0:42 > 68:ef:bd:ea:a6:c0, ethertype 802.1Q (0x8100), length 70: vlan 255, p 0, ethertype IPv4, (tos 0x0, ttl 128, id 880, offset 0, flags [DF], proto TCP (6), length 52)
10.14.237.192.51130 > 10.3.237.8.8192: Flags [S], cksum 0x82bc (correct), seq 2434360485, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
0x0000: 68ef bdea a6c0 001a a0c2 e042 8100 00ff h..........B....
0x0010: 0800 4500 0034 0370 4000 8006 087a 0a0e ..E..4.p@....z..
0x0020: edc0 0a03 ed08 c7ba 2000 9119 64a5 0000 ............d...
0x0030: 0000 8002 2000 82bc 0000 0204 05b4 0103 ................
0x0040: 0308 0101 0402
I've also attached my analysis of the whole dump at:
http://www.pastebin.ca/2351377