12

I am trying to sniff the http headers by using tcpdump.

This filter works well but I can't understand it -

(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)

I've googled it but I can't find any useful info

Here is the whole tcpdump command

sudo tcpdump -A 'dst [dest host] or src [src host]  and tcp  and 
(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i eth0

2 Answers 2

19

It's not the BPF filter that gets http headers but the "-A" switch on your tcpdump command.

Your tcpdump command looks for tcp traffic to certain destination or from a certain source on eth0 where the final BPF filter involves a calculation that results in a non-zero total. With the "-A" option, it prints each packet in ASCII minus its link level header.

I've explained the calculation below but I believe there's some issues in the actual filter, possibly through copying and pasting. When you use these filters in tcpdump, you're using tcp bit-masking, which is typically used when examining fields that do not fall on byte boundaries

  • ip[2:2] refers to the two bytes (i.e. 3rd & 4th bytes) in the IP header, beginning at byte 2 (remember it starts at offset 0). This total represents the total length of the IP packet which can be a maximum of 65535 bytes.

For the bitmask here, for clarity, I've pre-pended a '0' so mask 0xf becomes 0x0f. The leading '0' on the mask is dropped as per the comment from GuyHarris below.

  • ip[0]&0x0f refers to the second half of byte 0 (i.e. the 1st byte) in the IP header, which will give you the IP header length in 32 bit words and as such, this is typically multiplied by 4 for such a calculation.

  • tcp[12]&0xf0) refers to the first half of byte 12 (i.e. the 11th byte), which is the data offset field, which specifies the size of the TCP header in 32-bit words and as such, this is typically multiplied by 4 for such a calculation.

You need to multiply the last 2 lengths by 4 because they are 32 bit/4 byte words and so need be translated to a total in bytes for the calculation to be correct

Your filter should be calculating:

  • The IP packet length (in bytes) - The IP header length - The TCP Header Length

and looking for that value to be zero, i.e. something like this

sudo tcpdump -A -nnpi eth0 '(ip[2:2] - ((ip[0]&0x0f)*4) - ((tcp[12]&0xf0)*4) != 0)'

When you perform the subtraction, you're looking for a non-zero total. This non-zero total means that there's data above layer 4, i.e. data in the tcp payload, typically application traffic.

You may also want to add port 80 assuming most http traffic is over port 80.

Such a filter is commonly used by security folk to detect data on a SYN, which is not normal but according to the RFCs, it is allowed. so the whole thing would look something like -

'tcp[13]=0x02 and (ip[2:2] - ((ip[0]&0x0f)*4) - ((tcp[12]&0xf0)*4) != 0)'

TCPIPGuide is a very good, free online guide on TCP/IP btw.

Updated: Modify the 'leading zero' section on the bitmask as per the update from Guy Harris.

9
  • 1
    0x0f and 0xf are the same thing; leading zeroes can be omitted in hex values. The code might read more clearly if the leading zeroes are present, however. The <<2 is the same as *4; the >>2, however, is /2 (divide by 2), which is wrong - it's probably a typo.
    – user862787
    Aug 2, 2012 at 17:38
  • 1
    Thanks a lot very comprehensive answer !
    – kingasmk
    Aug 2, 2012 at 23:32
  • 1
    @GuyHarris thx, I wasn't sure if the leading zero was dropped so just thought I'd put in my comment for clarity. Regarding >>2 being the same as *4, I simply changed it from >>2 for clarity, as *4 is pretty clear and felt it was necessary to explain the difference of the values (32-bit words versus bytes), and to remove doubt around the <<2 typo. Aug 3, 2012 at 9:08
  • 1
    Presumably you meant "<<2 being the same as *4" - shifting left by n is equivalent to multiplying by 2^n, and shifting right by n is equivalent to dividing by 2^n, so >>2, not <<2, is the typo there.
    – user862787
    Aug 8, 2012 at 2:10
  • 2
    @GuyHarris, I think the original filter which stated division by 4 is actually correct since the TCP header length field is located in the higher nibble of the byte. Thus, extracting the number that is stored there without proper shifting effectively multiplies the field's original value by 16, requiring a division by 4 for conversion to bytes.
    – Yoel
    Sep 25, 2015 at 14:06
0

The filter comes from the EXAMPLES section of tcpdump man page.

To print all IPv4 HTTP packets to and from port  80,  i.e.  print  only
packets  that  contain  data, not, for example, SYN and FIN packets and
ACK-only packets.  (IPv6 is left as an exercise for the reader.)
  tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

It would be understand as following:

  • ip[2:2]: IP Packet Total Length
          +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
ip[2:2] = |          Total Length         |
          +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  • ((ip[0]&0xf)<<2)): IP Header Length
        +-+-+-+-+-+-+-+-+
ip[0] = |Version|  IHL  |
        +-+-+-+-+-+-+-+-+
             +-+-+-+-+-+-+-+-+
ip[0]&0xf =  |# # # #|  IHL  | <-- IP Header Length
             +-+-+-+-+-+-+-+-+
  • ((tcp[12]&0xf0)>>2)): TCP Header Length
          +-+-+-+-+
          |  TCP  |
tcp[12] = |  Data |
          | Offset| 
          +-+-+-+-+
                       +-+-+-+-+
                       |  TCP  |
((tcp[12]&0xf0)>>2)) = |  Data | <-- TCP Header Length
                       | Offset| 
                       +-+-+-+-+
  • >>2 is confused, take it apart step by step:
    • (tcp[12]&0xf0): take the upper 4 bits of the 12th octet data offset in the tcp header
    • ((tcp[12]&0xf0)>>4): right shift 4 bits to to get the size in 32-bit words.
    • (((tcp[12]&0xf0)>>4)<<2: left shift 2 bits to get the size in bytes
    • (((tcp[12]&0xf0)>>4)<<2 is shortened as (tcp[12]&0xf0)>>2)

So

(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)

is

(((IP Packet Total Length) - (IP Header Length) - (TCP Header Length)) != 0)

It matches any IPv4 packet that contains data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.