ECN flags to TCP packet format.
-.\" @(#) $Header: /tcpdump/master/tcpdump/Attic/tcpdump.1,v 1.111 2001-10-03 16:45:55 guy Exp $ (LBL)
+.\" @(#) $Header: /tcpdump/master/tcpdump/Attic/tcpdump.1,v 1.112 2001-10-19 20:03:08 fenner Exp $ (LBL)
.\"
.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
.\" The Regents of the University of California. All rights reserved.
.\"
.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
.\" The Regents of the University of California. All rights reserved.
.HD
.B Capturing TCP packets with particular flag combinations (SYN-ACK, URG-ACK, etc.)
.PP
.HD
.B Capturing TCP packets with particular flag combinations (SYN-ACK, URG-ACK, etc.)
.PP
-There are 6 bits in the control bits section of the TCP header:
+There are 8 bits in the control bits section of the TCP header:
-.I URG | ACK | PSH | RST | SYN | FIN
+.I CWR | ECE | URG | ACK | PSH | RST | SYN | FIN
.PP
Let's assume that we want to watch packets used in establishing
a TCP connection.
.PP
Let's assume that we want to watch packets used in establishing
a TCP connection.
-----------------------------------------------------------------
| acknowledgment number |
-----------------------------------------------------------------
-----------------------------------------------------------------
| acknowledgment number |
-----------------------------------------------------------------
-| HL | reserved |U|A|P|R|S|F| window size |
+| HL | rsvd |C|E|U|A|P|R|S|F| window size |
-----------------------------------------------------------------
| TCP checksum | urgent pointer |
-----------------------------------------------------------------
-----------------------------------------------------------------
| TCP checksum | urgent pointer |
-----------------------------------------------------------------
.PP
A TCP header usually holds 20 octets of data, unless options are
present.
.PP
A TCP header usually holds 20 octets of data, unless options are
present.
-The fist line of the graph contains octets 0 - 3, the
+The first line of the graph contains octets 0 - 3, the
second line shows octets 4 - 7 etc.
.PP
Starting to count with 0, the relevant TCP control bits are contained
second line shows octets 4 - 7 etc.
.PP
Starting to count with 0, the relevant TCP control bits are contained
.nf
0 7| 15| 23| 31
----------------|---------------|---------------|----------------
.nf
0 7| 15| 23| 31
----------------|---------------|---------------|----------------
-| HL | reserved |U|A|P|R|S|F| window size |
+| HL | rsvd |C|E|U|A|P|R|S|F| window size |
----------------|---------------|---------------|----------------
| | 13th octet | | |
.fi
----------------|---------------|---------------|----------------
| | 13th octet | | |
.fi
.nf
| |
|---------------|
.nf
| |
|---------------|
|---------------|
|7 5 3 0|
.fi
.PP
|---------------|
|7 5 3 0|
.fi
.PP
-We see that this octet contains 2 bits from the reserved field.
-According to RFC 793 this field is reserved for future use and must
-be 0.
-The remaining 6 bits are the TCP control bits we are interested
+These are the TCP control bits we are interested
in.
We have numbered the bits in this octet from 0 to 7, right to
left, so the PSH bit is bit number 3, while the URG bit is number 5.
in.
We have numbered the bits in this octet from 0 to 7, right to
left, so the PSH bit is bit number 3, while the URG bit is number 5.
with the SYN bit set in its header:
.PP
.nf
with the SYN bit set in its header:
.PP
.nf
|---------------|
|0 0 0 0 0 0 1 0|
|---------------|
|7 6 5 4 3 2 1 0|
.fi
.PP
|---------------|
|0 0 0 0 0 0 1 0|
|---------------|
|7 6 5 4 3 2 1 0|
.fi
.PP
-We already mentioned that bits number 7 and 6 belong to the
-reserved field, so they must must be 0.
Looking at the
control bits section we see that only bit number 1 (SYN) is set.
.PP
Looking at the
control bits section we see that only bit number 1 (SYN) is set.
.PP
with SYN-ACK set arrives:
.PP
.nf
with SYN-ACK set arrives:
.PP
.nf
|---------------|
|0 0 0 1 0 0 1 0|
|---------------|
|---------------|
|0 0 0 1 0 0 1 0|
|---------------|