Ethereal-dev: Re: [Ethereal-dev] TCP analysis and relative sequence numbers

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Sat, 3 Aug 2002 15:22:33 +0200
On Sat, Aug 03, 2002 at 09:08:02AM +1000, Ronnie Sahlberg wrote:
> The patch does not work with wrapping sequence numbers but that should be so
> rare that
> I dont know if it would be worth the (semi-significant) effort to update it
> to handle that as well.
> Well, if someone really really wants it to handle wrapping sequence numbers,
> I can look into it.

I've created a small patch that tries to take care of the problem. The only
check it passed is, that it compiles :-)
Please let me know if I missed anything or got things wrong.

 Ciao
  Jörg

--
Joerg Mayer                                          <jmayer@xxxxxxxxx>
I found out that "pro" means "instead of" (as in proconsul). Now I know
what proactive means.
Index: ethereal/packet-tcp.c
===================================================================
RCS file: /usr/local/cvsroot/ethereal/packet-tcp.c,v
retrieving revision 1.148
diff -u -r1.148 packet-tcp.c
--- ethereal/packet-tcp.c	2 Aug 2002 23:36:03 -0000	1.148
+++ ethereal/packet-tcp.c	3 Aug 2002 13:16:41 -0000
@@ -131,6 +131,13 @@
 	nstime_t ts;
 };
 
+/* Idea for gt: either x > y, or y is much bigger (assume wrap) */
+#define GT_SEQ(x, y) ((x > y) || ((y - x) > 0x80000000))
+#define LT_SEQ(x, y) ((x < y) || ((x - y) > 0x80000000))
+#define GE_SEQ(x, y) ((x >= y) || ((y - x) > 0x80000000))
+#define LE_SEQ(x, y) ((x <= y) || ((x - y) > 0x80000000))
+#define EQ_SEQ(x, y) (x == y)
+
 static GMemChunk *tcp_acked_chunk = NULL;
 static int tcp_acked_count = 5000;	/* one for almost every other segment in the capture */
 #define TCP_A_RETRANSMISSION	0x01
@@ -283,7 +290,7 @@
 	/* if we get past here we know that ual1 points to a segment */
 
 	/* if seq is beyond ual1->nextseq we have lost a segment */
-	if( seq>ual1->nextseq ){
+	if (GT_SEQ(seq, ual1->nextseq)) {
 		struct tcp_acked *ta;
 
 		ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
@@ -304,7 +311,7 @@
 	/* keep-alives are empty semgents with a sequence number -1 of what
 	 * we would expect.
 	 */
-	if( (!seglen) && (seq==(ual1->nextseq-1)) ){
+	if( (!seglen) && EQ_SEQ(seq, (ual1->nextseq-1)) ){
 		struct tcp_acked *ta;
 
 		ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
@@ -319,7 +326,7 @@
 	}
 
 	/* check if the sequence number is lower than expected, i.e. retransmission */
-	if( seq < ual1->nextseq ){
+	if( LT_SEQ(seq, ual1->nextseq )){
 		struct tcp_acked *ta;
 
 		ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
@@ -328,7 +335,7 @@
 		/* did this segment contain any more data we havent seen yet?
 		 * if so we can just increase nextseq
 		 */
-		if((seq+seglen)>ual1->nextseq){
+		if(GT_SEQ((seq+seglen), ual1->nextseq)){
 			ual1->nextseq=seq+seglen;
 			ual1->frame=pinfo->fd->num;
 			ual1->ts.secs=pinfo->fd->abs_secs;
@@ -377,7 +384,7 @@
 	 * we must have lost packets. Not much point in keeping the segments
 	 * in the other direction either.
 	 */
-	if( ack>ual2->nextseq ){
+	if( GT_SEQ(ack, ual2->nextseq )){
 		struct tcp_acked *ta;
 
 		ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
@@ -391,7 +398,7 @@
 
 
 	/* does this ACK ack all semgents we have seen in the other direction?*/
-	if( ack==ual2->nextseq ){
+	if( EQ_SEQ(ack, ual2->nextseq )){
 		struct tcp_acked *ta;
 
 		ta=tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE);
@@ -415,7 +422,7 @@
 	 * update and remove the ACKed segments
 	 */
 	for(ual=ual2;ual->next;ual=ual->next){
-		if(ack>=ual->next->nextseq){
+		if( GE_SEQ(ack, ual->next->nextseq)){
 			break;
 		}
 	}