TCP-Flags are wrong in Preprocessor

Hi all,

I am working on a preprocessor that evaluates TCP flags. I experience
some strange values for the flags provided in (SFSnortPacket*)
pkt->tcp_header->flags.

I am using snort-2.9.9.0 and for the tests, I used the following pcap:
http://panda.gtisc.gatech.edu/malrec/pcap/ca59a9cd-3b81-4763-95c6-42292cf42798.pcap

The preprocessor evaluates the flags in the following way:

  if( p->tcp_header->flags & TCPHEADER_CWR ){
    _dpd.logMsg(" CWR");
  }
  if( p->tcp_header->flags & TCPHEADER_ECE ){
    _dpd.logMsg(" ECE");
  }
  if( p->tcp_header->flags & TCPHEADER_URG ){
    _dpd.logMsg(" URG");
  }
  if( p->tcp_header->flags & TCPHEADER_ACK ){
    _dpd.logMsg(" ACK");
  }
  if( p->tcp_header->flags & TCPHEADER_PUSH ){
    _dpd.logMsg(" PSH");
  }
  if( p->tcp_header->flags & TCPHEADER_RST ){
    _dpd.logMsg(" RST");
  }
  if( p->tcp_header->flags & TCPHEADER_SYN ){
    _dpd.logMsg(" SYN");
  }
  if( p->tcp_header->flags & TCPHEADER_FIN ){
    _dpd.logMsg(" FIN");
  }

Using the above pcap, the output for the first TCP packet is:

ACK PSH

Examining the first TCP packet in wireshark shows the flags as follows:

0x002 (SYN)


Same problem with the checksum value, which is 0xb3d4 in the PP and
0x415d in wireshark.


What am I missing? Can anyone help me?

Kind regards
- Matthias

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

-----BEGIN PGP SIGNATURE-----

iQFXBAEBCABBFiEEu2qnN25k6GckwaNL19kKxE4457YFAllKysMjHG1hdHRoaWFz
Lnd1ZWJiZWxpbmdAY3MudW5pLWJvbm4uZGUACgkQ19kKxE4457az2Qf9FnIabAQv
PuhdQ8ncEsliWW0NgcdjuLXxoNCpOqdLqhTr8LW1o9FL7rBWxE2++LtustFAldvY
XO/gdoNXHxPvGJccY5DLJgFPcTNdr4ct0h02fmoY5mqlPMO9xC5KJGl4W5NecsDt
odTJuSMpR0qF1HExpoJqRzwNuZ1odvF9zCBZfw8jWY4f9if/v68F+ux9lVIHlpmi
zzqQa1YKiD/jFP/72WmvdIAGjhTZdNWw4Xm0ZmZ2jNZSE60NSmswOX6vL4CQEERP
0Z62OyXuRbPaW1sy8COjkdd8jRsJvrK3CG4qOvi3vlkC/PCIlUlVktquPnXxOtCQ
hQ6jux68hD9Wkw==
=0Pg8
-----END PGP SIGNATURE-----