how to decode packet data, packet analysis

Question

I need help for my project. I not good at this. here are my server receiver. this coding is done for the physical pc. basically this coding in physical pc is to receive the data packet from the virtual receiver. It works. but somehow i had problem in decode the packet info and i noob at all this.

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
#define snprintf _snprintf
#define ETH_ALEN 6
#define IP_ALEN 4
#define ARP_REQUEST 1
#define ARP_REPLY 2

#include <stdlib.h>
#include <stdio.h>
#include <winsock2.h>
#include <pcap.h>

#pragma comment(lib, "wpcap.lib")
#pragma comment(lib, "Ws2_32.lib")


// A sample of the select() return value
int recvfromTimeOutUDP(SOCKET socket, long sec, long usec)
{
  // Setup timeval variable
  struct timeval timeout;
  struct fd_set fds;

  timeout.tv_sec = sec;
  timeout.tv_usec = usec;
  // Setup fd_set structure
  FD_ZERO(&fds);
  FD_SET(socket, &fds);
  // Return value:
  // -1: error occurred
  // 0: timed out
  // > 0: data ready to be read
  return select(0, &fds, 0, 0, &timeout);
}


int main(int argc, char **argv)
{
  WSADATA            wsaData;
  SOCKET             ReceivingSocket;
  SOCKADDR_IN        ReceiverAddr;
  int                Port = 5150;
  char          ReceiveBuf[6000];
  int                BufLength = 6000;
  SOCKADDR_IN        SenderAddr;
  int                SenderAddrSize = sizeof(SenderAddr);
  int                ByteReceived = 5, SelectTiming, ErrorCode;
  char ch = 'Y';

 // Initialize Winsock version 2.2
 if( WSAStartup(MAKEWORD(2,2), &wsaData) != 0)
 {
     printf("Server: WSAStartup failed with error %ld\n", WSAGetLastError());
     return -1;
 }
 else
       printf("Server: The Winsock DLL status is %s.\n", wsaData.szSystemStatus);

       // Create a new socket to receive datagrams on.
       ReceivingSocket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);

       if (ReceivingSocket == INVALID_SOCKET)
       {
         printf("Server: Error at socket(): %ld\n", WSAGetLastError());
         // Clean up
         WSACleanup();
         // Exit with error
         return -1;
        }
        else
        printf("Server: socket() is OK!\n");

        // Set up a SOCKADDR_IN structure that will tell bind that we
        // want to receive datagrams from all interfaces using port 5150.

        // The IPv4 family
        ReceiverAddr.sin_family = AF_INET;
        // Port no. 5150
        ReceiverAddr.sin_port = htons(Port);
        // From all interface (0.0.0.0)
        ReceiverAddr.sin_addr.s_addr = htonl(INADDR_ANY);

        // Associate the address information with the socket using bind.
        // At this point you can receive datagrams on your bound socket.
        if (bind(ReceivingSocket, (SOCKADDR *)&ReceiverAddr, sizeof(ReceiverAddr)) == SOCKET_ERROR)
         {
                   printf("Server: bind() failed! Error: %ld.\n", WSAGetLastError());
                   // Close the socket
                   closesocket(ReceivingSocket);
                   // Do the clean up
                   WSACleanup();
                   // and exit with error
                   return -1;
                 }
                 else
                 printf("Server: bind() is OK!\n");

       // Some info on the receiver side...
      getsockname(ReceivingSocket, (SOCKADDR *)&ReceiverAddr, (int *)sizeof(ReceiverAddr));

      printf("Server: Receiving IP(s) used: %s\n", inet_ntoa(ReceiverAddr.sin_addr));
      printf("Server: Receiving port used: %d\n", htons(ReceiverAddr.sin_port));
      printf("Server: I\'m ready to receive a datagram...\n");

      SelectTiming = recvfromTimeOutUDP(ReceivingSocket, 100, 0);

      switch (SelectTiming)
      {
         case 0:
             // Timed out, do whatever you want to handle this situation
             printf("Server: Timeout while waiting for client!...\n");
             break;
         case -1:
             // Error occurred, maybe we should display an error message?
            // Need more tweaking here and the recvfromTimeOutUDP()...
             printf("Server: Some error encountered with code number: %ld\n", WSAGetLastError());
             break;
         default:
             {
                  while (1)


                  {
                       // Call recvfrom() to get it then display the received data...
                       ByteReceived = recvfrom(ReceivingSocket, ReceiveBuf, BufLength,
                                                0, (SOCKADDR *)&SenderAddr, &SenderAddrSize);
                       if ( ByteReceived > 0 )
                       {
                           printf("\n\nServer: Total Bytes received: %d\n", ByteReceived);
                           printf("Server: The data is \"%s\"\n", ReceiveBuf);
                       }
                       else if ( ByteReceived <= 0 )
                            printf("Server: Connection closed with error code: %ld\n",
                                        WSAGetLastError());
                       else
                            printf("Server: recvfrom() failed with error code: %d\n",
                                    WSAGetLastError());

                       // Some info on the sender side
                       getpeername(ReceivingSocket, (SOCKADDR *)&SenderAddr, &SenderAddrSize);
                       printf("Server: Sending IP used: %s\n", inet_ntoa(SenderAddr.sin_addr));
                       printf("Server: Sending port used: %d\n", htons(SenderAddr.sin_port));

                       printf("TIME -", ReceiveBuf);
                  }

             }





        }



       // When your application is finished receiving datagrams close the socket.
          printf("Server: Finished receiving. Closing the listening socket...\n");
          if (closesocket(ReceivingSocket) != 0)
              printf("Server: closesocket() failed! Error code: %ld\n", WSAGetLastError());
          else
              printf("Server: closesocket() is OK...\n");

      // When your application is finished call WSACleanup.
       printf("Server: Cleaning up...\n");
       if(WSACleanup() != 0)
          printf("Server: WSACleanup() failed! Error code: %ld\n", WSAGetLastError());
       else
          printf("Server: WSACleanup() is OK\n");
       // Back to the system
       // system("PAUSE");
       return 0;
 }

Below are example i get in my CLI in physical pc. i believe this is the packets by packets receive from the virtual receiver. I was confused how do i decode it into

 Server: Total Bytes received: 4000
 Server: The data is "Time : 10:32:24.759385   
 0050568214540064403a1c000800450000285aeb40007f06b0c4ac10a40bac10f3f3c0990d3d740222860176142f5010054e40620000000000000000"
 Server: Sending IP used: 172.16.243.243
 Server: Sending port used: 59079


 Server: Total Bytes received: 4000
 Server: The data is "Time : 10:32:24.759385
 0050568214540064403a1c000800450000285aeb40007f06b0c4ac10a40bac10f3f3c0990d3d740222860176142f5010054e40620000000000000000"
 Server: Sending IP used: 172.16.243.243
 Server: Sending port used: 59080

How do i decode the packet info analysis ?

decode it, something like this.

Sounds like you don't know the format of the received datagram? — ciphor, Jul 10 '12 at 15:20
@ciphor ya.. new to this. thanks, will read up about datagram. — Khein, Jul 11 '12 at 13:17

mathematician1975 · Answer 1 · 2012-07-09T10:17:53.460

You presumably wrote the data to a byte buffer in order to send it. When receiving it you just need to read back the data in from your receive buffer the same way that you wrote it. We can only see your receive code so we can only guess what you send, but lets say for example that you write 4 x 4 byte integers to a char buffer and then send over the socket. The receiving code will need to do something like

   int iData1 = 0;
   int iData2 = 0;
   int iData3 = 0;
   int iData4 = 0;
   char* szIt = ReceiveBuff;          // set a pointer to start of receive buffer
   memcpy(&iData1,szIt,sizeof(int);   // memcpy first item
   szIt += sizeof(int);               // point to location in buffer of next item   
   memcpy(&iData2,szIt,sizeof(int);   // memcpy second....
   szIt += sizeof(int);

   // Now do the rest of the data items until you have read 
   // everything in the packet

and so on for the next items. If you have different types then you need to increment the pointer by the size of those types. There are other ways you can do the same thing but this will work. A very important thing you need to consider when doing this is the endeanness of the machine you send on and receive from. You could enforce your data to write big endean so that the client knows and can deal with it if it is itself little endean.

The important thing is the order of the data you send and to interpret your byte buffer the same way on the client end.

Hope this helps

Hey! Thanks for the tips! I try but it didnt work. it didnt receive the buffer. Do you have any example, or website of this kind. Thank you so much. — Khein, Jul 10 '12 at 05:51
If you dont receive the buffer sounds like the problem might be in your client code. — mathematician1975, Jul 10 '12 at 11:32

how to decode packet data, packet analysis

1 Answers1