1

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...".

On page 61 it is written:

A common scenario is to capture only TCP packets with the RST flag set. We will cover TCP extensively in Chapte r 6. For now, you just need to know that the flags of a TCP packet are located at offset 13. This is an interesting field because it is collectively 1 byte in size as the flags field, but each particular flag is identified by a single bit within this byte. Multiple flags can be set simultaneously in a TCP packet, so we can’t efficiently filter by a single tcp[13] value because several may represent the RST bit being set. Therefore, we must specify the location within the byte that we wish to examine by appending that location to the current primitive with a single ampersand ( & ). The RST flag is at the bit representing the number 4 within this byte, and the fact that this bit is set to 4 tells us that the flag is set. The filter looks like this:

tcp[13] & 4 == 4

But when I look on TCP header on wiki, I see the RST flag is the 5th bit within the 13th byte (?)

enter image description here

My questions:

  1. Why is it looking for the 4th bit within the 13 byte (tcp[13] & 4) ? Shouldn't be the 5th like marked in the picture?
  2. Why is comparing the value of the flag with 4? TCP Contains 9 1-bit flags Shouldn't the value of flag be either 0 or 1 ?
  3. In order to check for URG flag, the book mentions filter tcp[13] & 32 == 32 which I really don't get?

Thanks!

Improve this question
2
  • & seems to be the "bitwise logical and" operator.
    – JeanPierre
    Commented Jul 20, 2018 at 20:55
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 25, 2018 at 9:07

1 Answer 1

Reset to default
3

The RST flag is at the bit representing the number 4 within this byte

refers to the numerical value of bit 2 (22 = 4) - the bits are numbered 76543210 from MSB to LSB with the numerical values 128, 64, 32, 16, 8, 4, 2, 1.

In the same manner, URG is bit 5 and 25 = 32.

Improve this answer
3
  • Great, now that makes sense! So if I want to read flag NS I would say tcp[12] & 0 == 1 ? Can you also tell me why is comparing the flag with the numerical value (question 2), shouldn't be 0 or 1 ?
    – Unix von Bash
    Commented Jul 20, 2018 at 21:10
  • Anything & 0 is always 0 - bit 0 has value 1 (2^0), so you use tcp[12] & 1 != 0. When you mask bits out with bitwise and (&), you clear all the other, the bit value is preserved -> test for bit 7: tcp[12] & 128 != 0 or tcp[12] & (1<<7) != 0.
    – Zac67 ♦
    Commented Jul 21, 2018 at 7:10
  • The Internet was designed for a military contract, and they required bits to be numbered 1 to N, starting from the MSB. That's the bit numbering in the Internet publications, such as RFCs. Everyone else uses powers-of-2, with the LSB having bit number 0 (ie, 2^0) and counting upwards towards the MSB. This is the bit numbering the programmers of tcpdump used.
    – vk5tu
    Commented Jul 21, 2018 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.