the size of the Ip works, but when I get the tcp packet, things don't work as planned--it gives invalid ports.
I see:
tcp = (tcp_hdr *) ((packet + sizeof (ether_hdr)) + ip_size); cout << "Source port: " << tcp->th_sport << "\t\tDestination port: " << tcp->th_dport << "." << endl; You forgot to use ntohs(). These are 16-bit on network order. --gv - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
