Home/ Questions/Q 8932897
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-15T09:24:37+00:00

I’m writing a program which sniffs IPv6 packets using libpcap and sends those packets

  • 0

I’m writing a program which sniffs IPv6 packets using libpcap and sends those packets through TCP/IP to a server.

Since IP(v6) packets are not multi-byte data, but are more like “a bunch of bits” I don’t use any marshalling (like htons…).

The odd thing is, I output the packets to stdout and they look fine, but when I transmit them over the net, they get all jumbled up. I used netcat to make sure my server is not the problem. The one packet arrived correctly, while the other packet has a different byte ordering. Any ideas why?

EDIT:
OK, so the awesome ‘nos’ was right, I have been fooled by hexdump. ‘hexdump -c’ shows the right output. However, the server part of my program (which to be honest, didn’t get as much love as the sender/client and I will rewrite it before posting the code here) sometimes does 2 reads and gets the correct data and most of the time gets it all at once and jumbles up the order.

The (sending) code:

struct pb_elem {
    size_t size;
    u_char *data;
};
-------------------------    

int send_all(int sockfd, packet_buf pbuf) {
int res = 0, n, i;
uint offset = 0, byteleft = 0;
struct pb_elem *packet;

res = packet_buf_dequeue(pbuf, &packet);
while (res == 0) {
    byteleft = packet->size;
    offset = 0;

    /* DEBUG */ fprintf(stderr, "DEBUG: send new packet\n");
    printf("DEBUG: Data size: %zu\n", packet->size);
    for (i=0; i < packet->size; i++) {
        printf(((i % 2 == 1) ? "%02X " : "%02X"), (unsigned int)*(packet->data+i));
    }
    printf("\n");

    do {
        n = send(sockfd, packet->data+offset, byteleft, 0);
        if (n == -1)
            break;
        offset = n;
        byteleft -= n;
        /* DEBUG */ fprintf(stderr, "DEBUG: send: offset: %u, byteleft: %u\n", offset, byteleft);
    } while (byteleft > 0);

    if (n == -1)
        fprintf(stderr, "Error: could not send whole packet.");

    free(packet->data);
    free(packet);

    res = packet_buf_dequeue(pbuf, &packet);
}

return 0;
}

Sample output from sniffer prog (sender) (2 ICMPv6 packets):

IPv6Buffer started
DATA:
0800 277B 1EBD 0A00 2700 0001 86DD 6000 0000 0035 3A40 2001 0DB8 BBBB 0000 0000 0000 0000 0001 2001 0DB8 BBBB 0000 0000 0000 0000 0102 8000 160B 116F 0001 09BD B450 0000 0000 DD2A 0500 0000 0000 CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CA
DATA:
0800 277B 1EBD 0A00 2700 0001 86DD 6000 0000 0035 3A40 2001 0DB8 BBBB 0000 0000 0000 0000 0001 2001 0DB8 BBBB 0000 0000 0000 0000 0102 8000 3E08 116F 0002 0ABD B450 0000 0000 B42C 0500 0000 0000 CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CA
DEBUG: start_sending
DEBUG: Data size: 107
0800 277B 1EBD 0A00 2700 0001 86DD 6000 0000 0035 3A40 2001 0DB8 BBBB 0000 0000 0000 0000 0001 2001 0DB8 BBBB 0000 0000 0000 0000 0102 8000 160B 116F 0001 09BD B450 0000 0000 DD2A 0500 0000 0000 CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CA
DEBUG: Data size: 107
0800 277B 1EBD 0A00 2700 0001 86DD 6000 0000 0035 3A40 2001 0DB8 BBBB 0000 0000 0000 0000 0001 2001 0DB8 BBBB 0000 0000 0000 0000 0102 8000 3E08 116F 0002 0ABD B450 0000 0000 B42C 0500 0000 0000 CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CA

What I receive with the server/receiver program:

IPv6Buffer started
DEBUG: start_receiving()
DEBUG: pre-accept in receive_data()
Data size: 214
0800 277B 1EBD 0A00 2700 0001 86DD 6000 0000 0035 3A40 2001 0DB8 BBBB 0000 0000 
0000 0000 0001 2001 0DB8 BBBB 0000 0000 0000 0000 0102 8000 2598 1280 0001 B3C8 
B450 0000 0000 2381 0400 0000 0000 CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE CAFE 
CAFE CAFE CAFE CAFE CAFE CA08 0027 7B1E BD0A 0027 0000 0186 DD60 0000 0000 353A 
4020 010D B8BB BB00 0000 0000 0000 0000 0120 010D B8BB BB00 0000 0000 0000 0001 
0280 007A 9712 8000 02B4 C8B4 5000 0000 00CD 8004 0000 0000 00CA FECA FECA FECA 
FECA FECA FECA FECA FECA FECA FECA FECA FECA FECA FECA
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    While I’m not entirely sure WHY the byte order was changed, I do have a fix.

    I just implemented a naive version of the receiving end, trying to receive as much data as would fit into the buffer with the size of the MTU.
    Usually both packets would be read and put together.

    Now that I have implemented a primitive “protocol” telling my receiver the size of the packet and thus receiving them separate, they do arrive in order.

    • 0