tcpdump broken wrt CsCov & CsVal parsing?

Trying to rebuild a proper test setup, so far using just loopback for simple tests I noticed this problem:

11:57:47.463084 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 5, cksum 0xf52a (correct), dataack (ack5231163474841) 11:57:47.463095 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 5, cksum 0x92f7 (correct), ack (ack5230668497611) 11:57:47.463219 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 10, cksum 0xe8d8 (correct), dataack (ack5231163474842) 11:57:47.463231 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 10, cksum 0xa7e9 (correct), ack (ack5230668497612) 11:57:47.463344 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 15, cksum 0xda86 (correct), dataack (ack5231163474843) 11:57:47.463355 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 15, cksum 0x166c (correct), ack (ack5230668497613) 11:57:47.463466 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 4, cksum 0xcf34 (correct), dataack (ack5231163474844) 11:57:47.463477 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 4, cksum 0x4f19 (correct), ack (ack5230668497614)

Who was the last person to touch the DCCP support code in tcpdump? Care to take a look?

- Arnaldo

I'm pretty sure that would be me :-(

I'll take a look but it won't be very soon.

Web1: http://wand.net.nz/~iam4/
Web2: http://www.jandi.co.nz
Blog: http://iansblog.jandi.co.nz

|  On 9/23/07, Arnaldo Carvalho de Melo <[email protected]> wrote:
|  > Trying to rebuild a proper test setup, so far using just loopback for
|  > simple tests I noticed this problem:
|  >
|  > Who was the last person to touch the DCCP support code in tcpdump? Care
|  > to take a look?
|  >
|  > - Arnaldo
|  
|  I'm pretty sure that would be me :-(
|  
|  I'll take a look but it won't be very soon.
|  

... and me too :) I know this problem - CsCov and CCVal were swapped in the header file. As far as I recall the maintainer had checked an update in last year.

You didn't say which version of tcpdump you were using, I checked locally:
* tcpdump 3.9.5 as Debian package with libpcap 0.9.5 has this swap-problem
* tcpdump 3.9.5 built from tcpdump source, with libpcap 0.9.4 works correct

Can you try tcpdump from source please and check if the problem persists?

Em Tue, Sep 25, 2007 at 09:08:29AM +0100, Gerrit Renker escreveu:

Excellent data point, I should know better and try with upstream before complaining. Ah, and also provide the tcpdump version:

[root@tonchinha ~]# rpm -q tcpdump
tcpdump-3.9.7-3.fc8

I'll check upstream now.

- Arnaldo

|  I checked locally:
|  >  * tcpdump 3.9.5 as Debian package with libpcap 0.9.5 has this swap-problem 
|  >  * tcpdump 3.9.5 built from tcpdump source, with libpcap 0.9.4 works correct
|  > 
|  > Can you try tcpdump from source please and check if the problem persists?
|  
|  Excellent data point, I should know better and try with upstream before
|  complaining. Ah, and also provide the tcpdump version:
|  
|  [root@tonchinha ~]# rpm -q tcpdump
|  tcpdump-3.9.7-3.fc8

Have you looked at the source rpm's? I found the old patch, if the following hunk applies then quite likely they have forgotten to patch the header file, and the problem could be solved then (CCval and Cscov were swapped):

@@ -36,8 +36,8 @@ struct dccp_hdr {
 	}		dccph_xtrs;
 };
 
-#define DCCPH_CCVAL(dh)	(((dh)->dccph_ccval_cscov) & 0x0F)
-#define DCCPH_CSCOV(dh)	(((dh)->dccph_ccval_cscov >> 4) & 0x0F)
+#define DCCPH_CCVAL(dh)	(((dh)->dccph_ccval_cscov >> 4) & 0xF)
+#define DCCPH_CSCOV(dh)	(((dh)->dccph_ccval_cscov) & 0xF)
 
 #define DCCPH_X(dh)	((dh)->dccph_xtrs.dccph_xtr & 1)
 #define DCCPH_TYPE(dh)	(((dh)->dccph_xtrs.dccph_xtr >> 1) & 0xF)