|
This data
will be carried to the layers above, while the TCP
header will be stripped and disregarded. In this
example, we have no data, which is normal since the
packet is initiating a 3-way handshake (Flags, SYN=1),
but we will cover that in more depth on the next
page.
The main
issue requiring our attention deals with the values
used for the header length field and learning how to
interpret them correctly.
Step 2
- Header Value Analysis
From
the screen shot above, we can see our packet sniffer
indicating that the field has a value of 7(hex) and
this is interpreted as 28 bytes. To calculate this,
you take the value of 7, multiply it by 32 and
divide the result by 8: 7x32=224/8=28 bytes.
Do you
recall the definition given at the beginning of this
page? "An interger that
specifies the length of the segment header measured
in 32-bit multiples". This was the
formal way of describing these calculations :)
The
calculation given is automatically performed by our
packet sniffer, which is quite thoughtful, wouldn't
you agree? This can be considered, if you like, as
an additional 'feature' found on most
serious packet sniffers.
Below
you will find another screen shot from our packet
sniffer that shows a portion of the TCP header (left
frame) containing the header length field. On the
right frame, the packet sniffer shows the packet's
contents in hex:
By
selecting the Header length field on the left, the
program automatically highlights the corresponding
section and hex value on the right frame. According
to the packet sniffer, the hex value '70' is the
value for the header length field.
If you
recall at the beginning of the page, we mentioned
the header length field being 4 bits long. This
means that when viewing the value in hex, we should
only have one digit or character highlighted, but
this isn't the case here because the packet sniffer
has incorrectly highlighted the '7' and '0'
together, giving us the impression that the field is
8 bits long!
Note: In hex,
each character e.g '7' represents 4 bits. This means
that on the right frame, only '7' should be
highlighted, and not "70". Furthermore, if we were
to convert '7' hex to binary, the result would be
'0111' (notice the total amount of bits is equal to
4).
Summary
The
'Header length' field is very simple as it contains
only a number that allows the receiving end to
calculate the number of bytes in the TCP Header. At
the same time, it is mandatory because without it
there is no way the receiver will know where the
data portion begins!
Logically, wherever the TCP header ends, the data
begins - this is clear in the screen shots provided
on this page. So, if you find yourself analysing
packets and trying to figure out where the data
starts, all you need to do is find the TCP Header,
read the "Header length" value and you can find
exactly where the data portion starts!
Next up
are the TCP flags that most of us have come across
when talking about the famous 3-way handshake and
virtual connections TCP creates before exchanging
data.
|
