Decoding an IP datagram dump manually

Question

I was practicing questions for this topic and I came across this question:

Look at the 40byte dump of an IP packet containing a TCP segment below (in hexadecimal).

45 20 03 c5 78 06 00 00 34 06 ca 1f d1 55 ad 71 c0 a8 01 7e
00 50 9a 03 3e 64 e5 58 df d0 08 b3 80 18 00 de 00 02 00 00

Identify all the fields of the IP and TCP header.

Source: Q1 of http://www.eng.utah.edu/~cs5480/homeworks/hw3_soln.pdf

Now I do have the datagram format layout of IPv4 in front of me. The thing I don't understand is that in the solution it says that header length is 20bytes but according to the format the bits 4-7 correspond to header length which is 0x03c5 = 965 bytes. However, in the solution 965bytes is the total datagram length.

Can someone explain this?

score 2 · Answer 1 · edited Apr 04 '14 at 14:16

2

have a look at this to dump your headers

https://metacpan.org/pod/distribution/Data-HexDump-Range/scripts/hdr_examples.pod#IPV4-header

edited Apr 04 '14 at 14:16

titanofold

2,852
1
15
21

answered Sep 14 '12 at 09:18

Nadim Khemir

57
4

Don Roby · Accepted Answer · 2012-04-27T10:13:15.317

1

digits != bits.

Assuming zero-based counting, 0x03c5 is hex digits 4-7 in your data.

Bits 4-7 would be the hex 5 appearing earlier. This header value represents the number of 32-bit words in the header, so you have to multiply by 4 to get 20 as the number of bytes.

edited Apr 27 '12 at 10:13

answered Apr 27 '12 at 09:57

Don Roby

40,677
6
91
113

Right... I'll fix that. – Don Roby Apr 27 '12 at 09:59
@Mat - I'll incorporate the final part of your comment now too. If I knew how to share credit for the answer, I'd be happy to. – Don Roby Apr 27 '12 at 10:11

score 0 · Answer 3 · answered Apr 27 '12 at 09:55

0

According to the linked PDF document:

IP header: IP version 4, Header Length: 20 bytes, ToS = 20, Total Length = 0x03c5 =
965 bytes, ...

Seems pretty clear to me - 20 bytes header length, 965 bytes total length (which matches Wikipedia on IPv4 headers quite nicely).

answered Apr 27 '12 at 09:55

Frank Schmitt

30,195
12
73
107

2

That would appear to be the solution that the OP is saying he doesn't understand. It's nice that you do, but I'm not sure this helps. – Don Roby Apr 27 '12 at 09:58
On second thoughts, you're probably right - shame on me. – Frank Schmitt Apr 27 '12 at 10:00

Decoding an IP datagram dump manually

3 Answers3