Mailing-List: contact dev-help@drill.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@drill.apache.org
From: Ted Dunning <tdunning@mapr.com>
To: Charles Givre <cgivre@gmail.com>, "dev@drill.apache.org"
	<dev@drill.apache.org>
Subject: Re: PCAP Issues
Thread-Topic: PCAP Issues
Thread-Index: AQHTgz9+DABxndL1Sk2BD4MUhdr66aNgIOjF
Date: Tue, 2 Jan 2018 06:42:15 +0000
Message-ID: <CY4PR16MB1831883ED273DC1DA6F653DBBE190@CY4PR16MB1831.namprd16.prod.outlook.com>
References: <738E9DAE-18BB-4ECE-8EE3-13AF68863FF7@gmail.com>
In-Reply-To: <738E9DAE-18BB-4ECE-8EE3-13AF68863FF7@gmail.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: mapr.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
	boundary="_000_CY4PR16MB1831883ED273DC1DA6F653DBBE190CY4PR16MB1831namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: ee09935b-c89d-4f21-80c6-08d551abf685
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Jan 2018 06:42:15.9057
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2573c0c8-6f2a-4418-a58a-a742cf6415fb
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR16MB1831
archived-at: Tue, 02 Jan 2018 16:54:34 -0000

--_000_CY4PR16MB1831883ED273DC1DA6F653DBBE190CY4PR16MB1831namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable


PacketConstants.ETHER_HEADER_LENGTH + getIPHeaderLength() +13 to get the wo=
rd that has the flags

Looks to me like


     getByte(raw, ipOffset + getIPHeaderLength() + 13)


is what you need. And this gets you the byte, not the word.
________________________________
From: Charles Givre <cgivre@gmail.com>
Sent: Monday, January 1, 2018 12:31:17 PM
To: dev@drill.apache.org
Cc: Ted Dunning
Subject: PCAP Issues

Hello all,
I was playing with the PCAP functionality in Drill and I wanted to add the =
TCP flags to the data that Drill is returning.  I was also interested in ad=
ding the TCP Sequence and Ack numbers as well.  I noticed that the code as =
written currently has a function in Packet.java which returns the TCP Seque=
nce number, however this was never added to the schema, so I added that and=
 rebuilt Drill, however, it doesn=92t seem to be returning the correct resu=
lt.  The file I was querying is attached to this email, and should in all c=
ases return a sequence number of zero.

Questions:
1.  Could someone please take a look at the code for the tcp_sequence and s=
ee if I did something wrong, or if the offset is not being calculated corre=
ctly
2.  I=92m trying to figure out the offsets for the various TCP flags.   I w=
ould think that the offset should be PacketConstants.ETHER_HEADER_LENGTH + =
getIPHeaderLength() +13 to get the word that has the flags and then from th=
ere, access the individual bits.  However, this doesn=92t seem to work.  Wh=
at am I missing?
Thanks and Happy New Year!
- C

--_000_CY4PR16MB1831883ED273DC1DA6F653DBBE190CY4PR16MB1831namp_--