diff options
Diffstat (limited to 'analyzer/utils')
| -rw-r--r-- | analyzer/utils/pcap.c | 5 | ||||
| -rw-r--r-- | analyzer/utils/pcap.h | 3 |
2 files changed, 6 insertions, 2 deletions
diff --git a/analyzer/utils/pcap.c b/analyzer/utils/pcap.c index cdefba7..5e9b611 100644 --- a/analyzer/utils/pcap.c +++ b/analyzer/utils/pcap.c @@ -4,7 +4,7 @@ #include <netinet/ip.h> #include <netinet/tcp.h> -const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len) { +const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len, uint32_t *tcp_seq) { // get Ethernet header const struct ether_header *eth_header = (const struct ether_header *)packet; int eth_header_len = sizeof(struct ether_header); @@ -29,6 +29,9 @@ const unsigned char *get_payload_from_packet(const unsigned char *packet, const const struct tcphdr *tcp_header = (const struct tcphdr *)(packet + eth_header_len + ip_header_len); int tcp_header_len = tcp_header->th_off * 4; + // get TCP sequence number + *tcp_seq = ntohl(tcp_header->seq); + // get payload int total_header_len = eth_header_len + ip_header_len + tcp_header_len; *payload_len = packet_data->caplen - total_header_len; diff --git a/analyzer/utils/pcap.h b/analyzer/utils/pcap.h index d31b961..16da7cd 100644 --- a/analyzer/utils/pcap.h +++ b/analyzer/utils/pcap.h @@ -8,6 +8,7 @@ // - packet - captured packet // - packet_data - metadata about packet // - payload_len - pointer to save the payload length to or -1 if not a correct packet +// - tcp_seq - pointer to save the TCP sequence number // returns: // pointer to the payload or NULL if not a correct packet -extern const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len); +extern const unsigned char *get_payload_from_packet(const unsigned char *packet, const struct pcap_pkthdr *packet_data, int *payload_len, uint32_t *tcp_seq); |