Hi,
Can you tell me, if the TCP length is advertised as 73
characters, will tcpdump -X just print out 73 characters, or it will
it pad to a 74th? Here's some sample output:
18:50:23.380368
mail.millikin.edu.pop3 > math.millikin.edu.49342: P [tcp sum ok]
2337757198:2337757231(33) ack 3129613746 win 6144 (DF) (ttl 128, id
38612, len 73)
0x0000 4500 0049 96d4 4000 8006 0990 ac10 0113 E..I..@.........
0x0010 ac10 0117 006e c0be 8b57 580e ba8a 1db2 .....n...WX.....
0x0020 5018 1800 ee89 0000 2b4f 4b20 4772 6f75 P.......+OK.Grou
0x0030 7057 6973 6520 504f 5033 2073 6572 7665 pWise.POP3.serve
0x0000 4500 0049 96d4 4000 8006 0990 ac10 0113 E..I..@.........
0x0010 ac10 0117 006e c0be 8b57 580e ba8a 1db2 .....n...WX.....
0x0020 5018 1800 ee89 0000 2b4f 4b20 4772 6f75 P.......+OK.Grou
0x0030 7057 6973 6520 504f 5033 2073 6572 7665 pWise.POP3.serve
0x0040
7220 7265 6164 790d
0a42
r.ready..B
You can see that len is 73, yet 74 characters are being
printed.
This is with tcpdump for Mac OS X 10.1.
Thanks,
Michael
--
---------------------------------
Dr. Michael Rogers
e-mail: [EMAIL PROTECTED]
Phone: 217-424-6327
For information about Computer Science at Millikin University, visit http://math.millikin.edu
For information about astronomy, check out http://twincityamateurastronomers.org
Dr. Michael Rogers
e-mail: [EMAIL PROTECTED]
Phone: 217-424-6327
For information about Computer Science at Millikin University, visit http://math.millikin.edu
For information about astronomy, check out http://twincityamateurastronomers.org
