Extract payload with libpcap

Applications Programming
1

hi! :slight_smile:

im having a problem while extracting payload from a tcp packet that is captured with libpcap. this is what ive got so far:

const struct ethernet_header *ethernet;
    const struct ip_header *ip;
    const struct tcp_header *tcp;
    const char *payload;
    u_int size_ip;
    u_int size_tcp;

    ip = (struct ip_header*)(packet + SIZE_ETHERNET);
    size_ip = IP_HL(ip)*4;    

    tcp = (struct tcp_header*)(packet + SIZE_ETHERNET + size_ip);
    size_tcp = TH_OFF(tcp)*4;
    
   payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_tcp);

the result look like this:

actual payload: foobar
my program shows: foobar

actual payload 2: foo
my program shows:
foo
ar

data from the last payload is still there somehow.. maybe i need to clean the memory or something after each packet.. i dunno!

hope youll understand! thanks :smiley:

---------- Post updated at 11:58 AM ---------- Previous update was at 07:45 AM ----------

another question:

how do i get the correct seq and ack numbers from the tcp struct? when i print them i get just get really big numbers.. and when i check them in wireshark they should be like 1,2,3