1

I've got a program that reads 32-bit unsigned int values off the wire when stores them in an SQLITE3 database then retrieves them but somewhere along the line the data is being lost.

// The data is captured off the wire

//Stored and printed as a 32-bit number 
int32_t seq_num = ntohl(tcp->th_seq); // tcp->th_seq is the number
printf("Seq Num: %" PRIu32 "\n", seq_num);

// Function delcaration (variable as 32bit int)
void addPacket(int table, char *srcIP, char *dstIP, int port, int32_t seq_num);

// Function called with 32bit sequence number
addPacket(0, result1, result2, ntohs(tcp->th_dport), seq_num);

This is the SQLITE create database statement:

sql1 = "CREATE TABLE synpackets ("  \
       "id INTEGER PRIMARY KEY AUTOINCREMENT," \
       "srcIP VARCHAR(64)," \
       "dstIP VARCHAR(64)," \
       "dstPort int(4)," \
       "seq int(64)," \ // Could this be the problem?
       "timestamp DATETIME DEFAULT CURRENT_TIMESTAMP);";

And this is how I bind the parameter during the INSERT statement:

sqlite3_bind_int64(stmt, 4, seq_num);

When I read the numbers back out doing SELECT * ... I'm getting some negative numbers instead of the values that I intended to go in:

This is the original capture as it's happening before it goes into the database:

Packet number 38:
Seq Num: 1118349056

Packet number 39:
Seq Num: 768809646

And this is the same packet but after it's been retrieved from the database:

id = 1
seq = 1118349056

id = 2
seq = -1752457962

I've looked at the database file at the negative number is being written to the table so it's not just a printing error. Something seems to be going wrong when I try to insert the 32-bit numbers to the database, but I'm unsure what.

Crizly
  • 971
  • 1
  • 12
  • 33

0 Answers0