Getting two bits as one

[Protoroll]

I need to combine two bits in the same array so that I can display the TCP source and destination. With my code I pull in all the information from the packet and go to work on all of the individual parts.
Here is my TCP section

TCP_source = eth_buffer + 34;
	TCP_dest = eth_buffer + 36;
	for (i = 34; i < 36; i++)
	{
		TCP_source[i-34] = eth_buffer[i];
	}
	for (i = 36; i < 38; i++)
	{
		TCP_dest[i-36] = eth_buffer[i];
	}

I can get the TCP source to work because on the example packet I have the two source bits are 00 and 50. I can get the port 80 to print out, but the destination bits are 98 and 63 and I need them to get together so I can print out port 39011 for the destination port. Any help would be greatly appreciated.

[L7Sqr]

If you are dealing with ethernet frames there are structures available to manage the contents. For instance, on a linux machine you might look in /usr/include/netinet/. One of the files in there is tcp.h which provides a structure that maps to the data you are trying to read.

Also, there are utility routines for managing data such as ntohl (and family) so you can be sure that the order of the data is correct.

One other thing... bits are binary. 50 is not a valid binary value. I believe that you are speaking of bytes.

[Protoroll]

I think I understand what you're trying to say but I know where the bits are and I have them stored. All of the bytes are stored in the eth_buffer variable. I attached the the the packet file I was given and is a free program called wireshark that breaks it down. I know I can print out the the individual bytes but I need to get those bytes together so that can display the proper number.

[L7Sqr]

I think you are missing what I am saying. You can map a struct to those bytes to read them instead of trying to handle the bytes individually. Here is a short example to show what I mean (using your particular values)

#include <stdio.h>

struct foo {
    unsigned short sport, dport;
};

int main () {
    /* modify endianess for my platform */
    unsigned char buff[4] = {0x50, 0x00, 0x63, 0x98};
    struct foo * foo = buff;
    printf ("sport: %d\n", foo->sport);
    printf ("dport: %d\n", foo->dport);
    return 0;
}

When I run that I get

sport: 80
dport: 39011

[Protoroll]

I'm think that I'm starting to get it. Now do I have to change how I read in the file? I have to read in the packet in and basically bit shift and find the ones I need. I tried your way but I get the error a value of "unsigned char*" cannot be used to initialize an entity of type "bind*". I do have mine structured a little differently. Mine is like this

unsigned char buff[4] = {TCP_source[0], TCP_source[1], TCP_dest[0], TCP_dest[1]};

and then I have this at the bottom.

struct bind * bind = buff;

[L7Sqr]

One thing I failed to mention in my post was that you will get a warning (or error depending on your settings) for the cast to a struct. To cast the buffer to the type you want would look something like the following:

unsigned char buff[4] = {TCP_source[0], TCP_source[1], TCP_dest[0], TCP_dest[1]};
struct bind * bind = (struct bind *)buff;

Remember, if you leave the bytes in that order you might get strange results if you do not mind the byte ordering. Network byte order is not always the same as host byte order. In my example I changed this explicitly in the array initialization in order to keep the example simple but if you want to do it properly you should account for this the proper way. Consider the following update to my example:

#include <stdio.h>
#include <arpa/inet.h>

struct foo {
    unsigned short sport, dport;
};

int main () {
    unsigned char buff[4] = {0x00, 0x50, 0x98, 0x63};
    struct foo * foo = (struct foo *)buff;
    printf ("sport: %d\n", ntohs(foo->sport));
    printf ("dport: %d\n", ntohs(foo->dport));
    return 0;
}

The ntohs properly swaps the byte order for your particular platform.