Re: [tkined] IP monitor

Aaron Dewell (dewell@woods.net)
Thu, 25 Sep 1997 20:02:18 -0800 (AKDT)

Erik Schoenfelder <schoenfr@gaertner.de> wrote:
> Well, at least always a good packet is sent and the reply packet looks
> good to. So the packet breaks in the kernel or in the ntping decoder.

I would say that the bytes are out of order, given that the
source address is being given in the type, code, and cksum.

... got icmp type 209 code 112 id 2048 (0x800) cksum 48645

source is 209.112.190.5 190 << 8 is 48640 + 5 = 48645.

I was working on decoding exactly where this order is assumed.
My best guess is that with linux, somewhere is assumed
little-endian, such that the packet comes in reversed from what
is expected. However, it is correct under Solaris on the same
type of machine.

I tried adding a call to swab(), but that didn't help much
either.

> The only suggestion, that comes to my mind, is be to recompile ntping
> and try again.

Done repeatedly.

_______________________________________________________________________
|Aaron Dewell ===> dewell@woods.net |
|aka local guru ===> dewell@greatland.net |
|http://www.woods.net/~dewell http://www.woods.net/ |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--
!! This message is brought to you via the `tkined & scotty' mailing list.
!! Please do not reply to this message to unsubscribe. To subscribe or
!! unsubscribe, send a mail message to <tkined-request@ibr.cs.tu-bs.de>.
!! See http://wwwsnmp.cs.utwente.nl/~schoenw/scotty/ for more information.