title: Build a tcp packet with libnet get incorrect tcp flags and window size
body: <p>I followed the synflood.c in &quot;Hacking: the art of exploitation&quot;, which build a tcp packet with libnet_build_tcp.</p>
  <pre><code>if (libnet_build_tcp(
      libnet_get_prand(LIBNET_PRu16),
      dest_port,
      libnet_get_prand(LIBNET_PRu32),
      libnet_get_prand(LIBNET_PRu32),
      TH_SYN,
      libnet_get_prand(LIBNET_PRu16),
      0,
      NULL,
      0,
      packet+LIBNET_IP_H) == -1)
    printf(&quot;Build tcp packet failed&quot;);
  </code></pre>
  <p>It looks well... But when I use wireshark or tcpdump to examine the tcp
  packets it create, I get:</p>
  <pre><code>20:58:10.722180 IP 91.114.233.61.63812 &gt; 172.17.170.79.80:  tcp 20 [bad hdr length 0 - too short, &lt; 20]
  </code></pre>
  <p>In wireshark I found a tcp packet(last 20 bytes).</p>
  <pre><code>0000  08 00 27 f3 fc 9e e8 39  df 08 f4 fb 08 00 45 10   ..'....9 ......E.
  0010  00 28 56 46 00 00 96 06  aa f5 b2 09 1b 1a ac 11   .(VF.... ........
  0020  aa 4f 0c 8c 00 50 56 46  00 00 67 d4 65 32 00 00   .O...PVF ..g.e2..
  0030  00 00 75 74 55 4f   
  </code></pre>
  <p>It looks like where should be tcpflags become zeros and the window size zeros too.</p>
  <p>I tried to modify the advised window size when built tcp packet, but still get zeros.</p>
  <p>Any instruction?</p>
  <p>PS： I examined it more and find in my 64 bit unix machine, libnet will give 8 bytes to seq and ack, which makes things strange...</p>
  <p>the libnet source for libnet_build_tcp is here</p>
  <pre><code>int
  libnet_build_tcp(u_short sp, u_short dp, u_long seq, u_long ack, u_char control,
              u_short win, u_short urg, const u_char *payload, int payload_s,
              u_char *buf)
  {
      struct libnet_tcp_hdr tcp_hdr;
  
      if (!buf)
      {
          return (-1);
      }
  
      tcp_hdr.th_sport   = htons(sp);    /* source port */
      tcp_hdr.th_dport   = htons(dp);    /* destination port */
      tcp_hdr.th_seq     = htonl(seq);   /* sequence number */
      tcp_hdr.th_ack     = htonl(ack);   /* acknowledgement number */
      tcp_hdr.th_flags   = control;      /* control flags */
      tcp_hdr.th_x2      = 0;            /* UNUSED */
      tcp_hdr.th_off     = 5;            /* 20 byte header */
      tcp_hdr.th_win     = htons(win);   /* window size */
      tcp_hdr.th_sum     = 0;            /* checksum done in userland */ 
      tcp_hdr.th_urp     = urg;          /* urgent pointer */
  
      if (payload &amp;&amp; payload_s)
      {
          /*
           *  Unchecked runtime error for buf + TCP_H + payload to be greater
           *  than the allocated heap memory.
           */
          memcpy(buf + LIBNET_TCP_H, payload, payload_s);
      }
      memcpy((u_char *)buf, (u_char *)&amp;tcp_hdr, sizeof(tcp_hdr));
      return (1);
  }
  </code></pre>
  <hr />
  <h3>Solved</h3>
  <p>Sorry, I checked the libnet-headers rather than the libnet-1.0-headers, it defines</p>
  <pre><code>struct libnet_tcp_hdr
  {
      u_short th_sport;       /* source port */
      u_short th_dport;       /* destination port */
      u_long th_seq;          /* sequence number */
      u_long th_ack;  
  </code></pre>
  <p>in 64 bit machine long int will occupy 8 bytes. I know what happened.</p>