Ethereal-dev: Re: [Ethereal-dev] Searching for packets with incorrect checksums

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Jim Fleming" <jfleming@xxxxxxxx>
Date: Tue, 18 Dec 2001 16:27:03 -0600
----- Original Message -----
From: "Guy Harris" <guy@xxxxxxxxxx>
To: "Jim Fleming" <jfleming@xxxxxxxx>
Cc: "Guy Harris" <guy@xxxxxxxxxx>; "Gilbert Ramirez" <gram@xxxxxxxxxxxxxxx>; "Michael Tuexen" <Michael.Tuexen@xxxxxxxxxxxxxxxxx>;
<ethereal-dev@xxxxxxxxxxxx>
Sent: Tuesday, December 18, 2001 3:55 PM
Subject: Re: [Ethereal-dev] Searching for packets with incorrect checksums


> > Sorry, IPv7 is an internal code-name for using the 0x8000 bit
> > of the offset field. My point was that when that bit is set (=1)
> > it shows up as 0 in the display and as an 0x80 in the hex dump.
>
> In what RFC or Internet draft is that specified?  Currently, we show
> only the DF and MF bits in that field.  There's a #define for 8000 for
> IP_CE, listed as a "Congestion" flag, but RFC 3168 seems to suggest that
> the ECN stuff shows up in the TOS field instead.
>

The left-most bit of the off-set field is normally 0.

http://www.dot-biz.com/IPv4/Tutorial/RIFRAFBSD4.4.txt

Apparently, someone thought they could use that bit for congestion
stuff that belongs in Layer 3 (TCP|UDP) not Layer 2 (IP), and they
left it hanging around in the code. The same can be said for TOS values.
Layer 2 needs all the bits it can get for addressing, to expand beyond
the 32-bits. A 20-byte header only has 160 bits, and as they say with
land, they are not making any more.

Jim Fleming
http://www.ddj.com/articles/search/search.cgi?q=fleming
Oct93: The C+@ Programming Language