Intrusion Analyst Packet Header Chart
IP and UDP
Copyright © Guy Bruneau, 2000-2001. All rights reserved.
|
4
|
5
|
00
|
0044
|
|
4-bit version
|
4-bit header length
|
8-bit type of service (TOS)
|
16-bit total length (in bytes)
|
|
4615
|
4000 (DF) or 2000 (MF)
|
|
16-bit identification
|
3-bit flags
|
13-bit fragment offset
|
|
40
|
11
|
d70d
|
|
8-bit time to live (TTL)
|
8-bit protocol
|
16-bit header checksum
|
|
c0a8 1e01
|
|
32-bit source IP address
|
|
8009 401a
|
|
32-bit destination IP address
|
|
Options (if any)
|
|
0035
|
0035
|
|
16-bit source port number
|
16-bit destination port number
|
|
0030
|
7a8a
|
|
16-bit UDP length
|
16-bit UDP checksum
|
|
a6ff 0000
|
|
Start of Data (if any)
|
|
TCPDump trace (20 bites IP header [without options] + 8 bites UDP header)
21:43:38.809994 seeker.domain > blackhole.isi.edu.domain: 42751 PTR? 3.0.17.10.in-addr.arpa. (40)
4500 0044 4615 0000 4011 d70d c0a8 1e01
8009 401a0035 0035 0030 7a8a a6ff 0000
0001 0000 0000 0000 0133 0130 0231 3702
3130 0769 6e2d 6164 6472 0461 7270 6100
000c 0001
