title: read from a PCap file and print out IP addresses and port numbers in c, but my result seem wrong
body: <p>I am reading a pcap file and I want to print out the ip address and port number of each packet. I am using code from <a href="http://www.tcpdump.org/pcap.htm" rel="nofollow">http://www.tcpdump.org/pcap.htm</a> and <a href="http://www.rhyous.com/2011/11/13/how-to-read-a-pcap-file-from-wireshark-with-c/" rel="nofollow">http://www.rhyous.com/2011/11/13/how-to-read-a-pcap-file-from-wireshark-with-c/</a>. </p>
  
  <p>Here is my code:</p>
  
  <pre><code>#define SIZE_ETHERNET 14
  #define ETHER_ADDR_LEN  6
  
  
  /* Ethernet header */
      struct sniff_ethernet {
          u_char ether_dhost[ETHER_ADDR_LEN]; /* Destination host address */
          u_char ether_shost[ETHER_ADDR_LEN]; /* Source host address */
          u_short ether_type; /* IP? ARP? RARP? etc */
      };
  
      /* IP header */
      struct sniff_ip {
          u_char ip_vhl;      /* version &lt;&lt; 4 | header length &gt;&gt; 2 */
          u_char ip_tos;      /* type of service */
          u_short ip_len;     /* total length */
          u_short ip_id;      /* identification */
          u_short ip_off;     /* fragment offset field */
      #define IP_RF 0x8000        /* reserved fragment flag */
      #define IP_DF 0x4000        /* dont fragment flag */
      #define IP_MF 0x2000        /* more fragments flag */
      #define IP_OFFMASK 0x1fff   /* mask for fragmenting bits */
          u_char ip_ttl;      /* time to live */
          u_char ip_p;        /* protocol */
          u_short ip_sum;     /* checksum */
          struct in_addr ip_src;
          struct in_addr ip_dst; /* source and dest address */
      };
      #define IP_HL(ip)       (((ip)-&gt;ip_vhl) &amp; 0x0f)
      #define IP_V(ip)        (((ip)-&gt;ip_vhl) &gt;&gt; 4)
  
      /* TCP header */
      struct sniff_tcp {
          u_short th_sport;   /* source port */
          u_short th_dport;   /* destination port */
          u_int32_t th_seq;       /* sequence number */
          u_int32_t th_ack;       /* acknowledgement number */
  
          u_char th_offx2;    /* data offset, rsvd */
      #define TH_OFF(th)  (((th)-&gt;th_offx2 &amp; 0xf0) &gt;&gt; 4)
          u_char th_flags;
      #define TH_FIN 0x01
      #define TH_SYN 0x02
      #define TH_RST 0x04
      #define TH_PUSH 0x08
      #define TH_ACK 0x10
      #define TH_URG 0x20
      #define TH_ECE 0x40
      #define TH_CWR 0x80
      #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
          u_short th_win;     /* window */
          u_short th_sum;     /* checksum */
          u_short th_urp;     /* urgent pointer */
  };
  
  int main(int argc, char *argv[])
  {
  
      //get file
       char *filename = argv[1];
  
       //error buffer
       char errbuff[PCAP_ERRBUF_SIZE];
  
       //open file and create pcap handler
       pcap_t * handler = pcap_open_offline(filename, errbuff);
  
       //The header that pcap gives us
      struct pcap_pkthdr *header;
  
      //The actual packet 
      const u_char *packet;   
  
        int packetCount = 0;
        int i;
  
        //write to file 
        FILE *fp = fopen ( "result.txt", "w" ) ;
  
        //tcp info
      const struct sniff_ethernet *ethernet; /* The ethernet header */
      const struct sniff_ip *ip; /* The IP header */
      const struct sniff_tcp *tcp; /* The TCP header */
      u_int size_ip;
      u_int size_tcp;
  
      while (pcap_next_ex(handler, &amp;header, &amp;packet) &gt;= 0)
      {
          // Show the packet number
          printf("Packet # %i\n", ++packetCount);
          fprintf(fp,"Packet # %i\n", packetCount);
  
          // Show the size in bytes of the packet
          printf("Packet size: %d bytes\n", header-&gt;len);
          fprintf(fp,"Packet size: %d bytes\n", header-&gt;len);
  
          // Show a warning if the length captured is different
          if (header-&gt;len != header-&gt;caplen)
              printf("Warning! Capture size different than packet size: %ld bytes\n", header-&gt;len);
  
          // Show Epoch Time
          printf("Epoch Time: %d:%d seconds\n", header-&gt;ts.tv_sec, header-&gt;ts.tv_usec);
          fprintf(fp,"Epoch Time: %d:%d seconds\n", header-&gt;ts.tv_sec, header-&gt;ts.tv_usec);
  
          ethernet = (struct sniff_ethernet*)(packet);
          ip = (struct sniff_ip*)(packet + SIZE_ETHERNET);
          size_ip = IP_HL(ip)*4;
          if (size_ip &lt; 20) {
              printf("   * Invalid IP header length: %u bytes\n", size_ip);
              return;
          }
          tcp = (struct sniff_tcp*)(packet + SIZE_ETHERNET + size_ip);
  
          printf("src port: %d dest port: %d \n", tcp-&gt;th_sport, tcp-&gt;th_dport);
          fprintf(fp,"src port: %d dest port: %d \n", tcp-&gt;th_sport, tcp-&gt;th_dport);
  
          printf("src address: %s dest address: %s \n",  inet_ntoa(ip-&gt;ip_src),  inet_ntoa(ip-&gt;ip_dst));
          fprintf(fp,"src address: %s dest address: %s \n",  inet_ntoa(ip-&gt;ip_src),  inet_ntoa(ip-&gt;ip_dst));
  
          printf("seq number: %u ack number: %u \n", (unsigned int)tcp-&gt; th_seq, (unsigned int)tcp-&gt;th_ack);
          fprintf(fp,"seq number: %u ack number: %u \n", (unsigned int)tcp-&gt; th_seq, (unsigned int)tcp-&gt;th_ack);
  
          // Add two lines between packets
          printf("\n");
          fprintf(fp,"\n");
      }
      fclose (fp);
       return(0);
  }
  </code></pre>
  
  <p>this is part of my result:</p>
  
  <pre><code>Packet # 1
  Packet size: 74 bytes
  Epoch Time: 1348895319:643493 seconds
  src port: 20480 dest port: 15578
  src address: 128.8.126.92 dest address: 128.8.126.92
  seq number: 3071009507 ack number: 2490081174
  
  Packet # 2
  Packet size: 66 bytes
  Epoch Time: 1348895319:643566 seconds
  src port: 15578 dest port: 20480
  src address: 192.168.5.162 dest address: 192.168.5.162
  seq number: 2490081174 ack number: 3087786723
  
  Packet # 3
  Packet size: 207 bytes
  Epoch Time: 1348895319:643720 seconds
  src port: 15578 dest port: 20480
  src address: 192.168.5.162 dest address: 192.168.5.162
  seq number: 2490081174 ack number: 3087786723
  
  Packet # 4
  Packet size: 66 bytes
  Epoch Time: 1348895320:127547 seconds
  src port: 20480 dest port: 15578
  src address: 128.8.126.92 dest address: 128.8.126.92
  seq number: 3087786723 ack number: 560766870
  
  Packet # 5
  Packet size: 1514 bytes
  Epoch Time: 1348895320:129417 seconds
  src port: 20480 dest port: 15578
  src address: 128.8.126.92 dest address: 128.8.126.92
  seq number: 3087786723 ack number: 560766870
  </code></pre>
  
  <p>The ip address is the same even though i used src and dst ip address. 
  The seq number and ack number seem to be too large.
  can anyone see what is causing my problem and how I can fix it. Thanks in advance. </p>