Re: tcpdump file link type header format - in detail

Thank you so much for your response Beyers. 

This is what I did:

1. TCPDUMP capture commands I tried so far: (I am running linux in Virtual Box). I tried the same in standalone linux too. 
tcpdump -i p2p1 -w final.dump
tcpdump -i p2p1 -f tcp -w final.dump
tcpdump -i p2p1 ip -w final.dump
tcpdump -i p2p1 tcp -w final.dump
tcpdump -i p2p1 -A -w final.dump
tcpdump -i p2p1 -x -A -w final.dump
tcpdump -i p2p1 -x -A -nn -vvv -w final.dump
All the commands produced different dumps indeed. 

2. My different versions of the .click config files
FromDump(/home/Vaidsu/ClickGUD/click-2.0.1/click-tutorial1/gud.dump, STOP true)
-> cip	:: MarkIPHeader  
-> ctcp :: CheckTCPHeader(DETAILS true)
-> Discard
DriverManager(pause, print >>details.drops ctcp.drops,
		print >>details.drops ctcp.drop_details)
I used MarkIPHeader, CheckIPHeader and even Align(2/4/8,0) offset. 
I also tried to use FromDump -> ToDump to convert from EN10MB trace to RAW IP trace. 

3. In addition to all these I tried to generate the same dump files in tshark, even WinDump and tried using it here. Also tried converting pcap wireshark dump and using it. 

4. I tried FromTcpdump too. 

The errors I got so far:
1. Bad Ip header
2. warning: first line suspicious; is this a tcpdump output file?
3. packet parse error - while using FromTcpdump
4. Importantly when I get no error, I found that the details.drops reported that all packets are not TCP. I bet there are lots of TCP flows in the trace. Wireshark could detect it. 
9420
9420	not TCP
0	bad packet length
0	bad TCP checksum

Sorry for the long mail. wanted to completely explain my attempts to get your help. I am stuck here. 
1. Do I need to create a file that capture RAW IP by avoiding link level headers? Or
2. Do I need to create my own parser to parse the dump files? 

Thanks in advance.  


________________________________________
From: [email protected] [[email protected]] on behalf of [email protected] [[email protected]]
Sent: Sunday, June 24, 2012 12:00 PM
To: [email protected]
Subject: click Digest, Vol 108, Issue 9

Send click mailing list submissions to
        [email protected]

To subscribe or unsubscribe via the World Wide Web, visit
        https://amsterdam.lcs.mit.edu/mailman/listinfo/click
or, via email, send a message with subject or body 'help' to
        [email protected]

You can reach the person managing the list at
        [email protected]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of click digest..."


Today's Topics:

   1. tcpdump file link type header format (Vaithiyanathan Sundaram)
   2. Re: tcpdump file link type header format (Beyers Cronje)


----------------------------------------------------------------------

Message: 1
Date: Sat, 23 Jun 2012 19:44:53 +0000
From: Vaithiyanathan Sundaram <[email protected]>
Subject: [Click] tcpdump file link type header format
To: "[email protected]" <[email protected]>
Message-ID:
        <2F4314DB472A5B4387DBE195EF7F79F4500AFD@BY2PRD0710MB365.namprd07.prod.outlook.com>

Content-Type: text/plain; charset="iso-8859-1"

Hello,

My first requirement is to generate TCP traffic with respect to the input in the form of tcpdump.
I tried using
FromDump(...)
-> CheckTCPHeader
-> My parser
-> TCPIPSend (according to the parser).

I am working on a shared buffer research. I need a tcp traffic generator as per the dump. My only problem is the tcpdump type. I could only collect a TCP dump with EN01B (ethernet) link type header. I think click elements requires RAW IP header format. How do I generate that? Is there any other way.

Please help. Thanks a lot.

Vaithiyanathan
Mailing list: [email protected]


------------------------------

Message: 2
Date: Sat, 23 Jun 2012 22:46:28 +0200
From: Beyers Cronje <[email protected]>
Subject: Re: [Click] tcpdump file link type header format
To: "[email protected]" <[email protected]>
Message-ID:
        <CAOO3n8WgdAE36QSv9R=74Fhx69sWcZT-_MPfZFiSTFo=OGRjig@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Have you actually tried running FromDump with that capture file? What error
are you getting?

Note you should include a MarkIPHeader or CheckIPHeader element before
CheckTCPHeader as it requires the IP header annotation to be set already.

Beyers

On Sat, Jun 23, 2012 at 9:44 PM, Vaithiyanathan Sundaram <
[email protected]> wrote:

> Hello,
>
> My first requirement is to generate TCP traffic with respect to the input
> in the form of tcpdump.
> I tried using
> FromDump(...)
> -> CheckTCPHeader
> -> My parser
> -> TCPIPSend (according to the parser).
>
> I am working on a shared buffer research. I need a tcp traffic generator
> as per the dump. My only problem is the tcpdump type. I could only collect
> a TCP dump with EN01B (ethernet) link type header. I think click elements
> requires RAW IP header format. How do I generate that? Is there any other
> way.
>
> Please help. Thanks a lot.
>
> Vaithiyanathan
> Mailing list: [email protected]
> _______________________________________________
> click mailing list
> [email protected]
> https://amsterdam.lcs.mit.edu/mailman/listinfo/click
>


------------------------------

_______________________________________________
click mailing list
[email protected]
https://amsterdam.lcs.mit.edu/mailman/listinfo/click


End of click Digest, Vol 108, Issue 9
*************************************