Hi Anoop Saldanha,<div><br></div><div>Thanks for your help. I understood the second method and it worked perfectly. printf prints to console normally :). Now i have the basic decoding, which gives me the src and dst address + some other data required for time being. </div>
<div><br></div><div>In-order to write the Detection module. Which files to Look up? </div><div> </div><div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>My Idea is to detect an flooding intially. Such that a signature should match the src and dest address and the rate of incoming packet's. </div>
<div><br></div><div>Could you give me a high level overview of where to start and look after could be very helpful :) </div><div><br></div><div>Thank you!.</div><div><br></div></blockquote></div>
<div><br></div><div><div class="gmail_quote">On Wed, Jul 25, 2012 at 6:37 PM, Anoop Saldanha <span dir="ltr"><<a href="mailto:anoopsaldanha@gmail.com" target="_blank">anoopsaldanha@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>On Wed, Jul 25, 2012 at 4:48 PM, Prabhakaran Kasinathan<br>
<<a href="mailto:prabhakaran1989@gmail.com" target="_blank">prabhakaran1989@gmail.com</a>> wrote:<br>
> Dear Developer's,<br>
><br>
> I have been working in decoding the IEEE802154 packets and 6LoWPAN packets.<br>
> It took some time to understand the decoding functionality. Pls Help!<br>
><br>
> Now my problem is,<br>
><br>
> One byte is missing when i try to separate the structure like ( uint16_t ,<br>
> uint8_t,here next 8 bit is missing, uint16_t ...) it jumps to the next 16<br>
> bit and next 16 bit and soo on! What is the problem here?<br>
><br>
> whereas it works correctly either if i use ( uint16_t , uint8_t<br>
> ,uint8_t,uint16_t ,uint16_t , and so.... ) or ( uint16_t ,uint16_t ,uint16_t<br>
> ,uint16_t , ... ) . I couldn't understand this.<br>
><br>
> Details :<br>
><br>
> The current Header of IEEE802154 packet.<br>
><br>
> octects 2 1 2 2 2<br>
> | FCF | Seq no | Dst Pan | Dst Add | Src Add | remaining data<br>
><br>
><br>
> Hex : 61 88 d9 22 00 01 00 64 00 e0 ... Data... [ the byte 22 is<br>
> missing when i print the hole order ]<br>
><br>
> My Structure Declarations<br>
><br>
> typedef struct Ieee802154Hdr_ {<br>
> uint16_t ieee802154_fcf;<br>
> uint8_t ieee802154_seq;<br>
> uint16_t ieee802154_dstpan;<br>
> uint16_t ieee802154_dstadd;<br>
> uint16_t ieee802154_srcadd;<br>
> } Ieee802154Hdr;<br>
><br>
> SCLogInfo("\n Length %d ieee FCF: %x | ieee seq %x | DstPan %04x |<br>
> Dstadd %04X | SrcAdd<br>
> %04x",len,ntohs(p->ieeeh->ieee802154_fcf),ntohs(p->ieeeh->ieee802154_seq),ntohs(p->ieeeh->ieee802154_dstpan),ntohs(p->ieeeh->ieee802154_dstadd),ntohs(p->ieeeh->ieee802154_srcadd));<br>
><br>
><br>
> Output is:<br>
><br>
> Length 26 ieee FCF: 6188 | ieee seq d9 | DstPan 0001 | Dstadd 0064 |<br>
> SrcAdd 00e0<br>
><br>
> it should<br>
> be 0022 0001 0064<br>
><br>
> Note: If I use the (uint16_t) continuously, I get the bytes correctly. How<br>
> to overcome this problem.<br>
><br>
<br>
</div></div>This is a gcc alignment issue. Can't think of any portable solutions as such.<br>
<br>
One way would be use a uint8_t array to point to the packet byte<br>
array, and use macros to dereference the various fields from this<br>
array.<br>
<br>
#DEFINE GET_IEEE802145_DSTPAN(array) (*((uint16_t *)((uint8_t *)array + 3))<br>
<br>
--<br>
<br>
Another solution would be to define the struct as<br>
<br>
{<br>
uint16_t a;<br>
uint8_t b;<br>
uint8_t c1;<br>
uint8_t c2;<br>
...<br>
}<br>
<br>
So c1 + c2 in your case would be ieee802154_dstpan. You can hide the<br>
retrieval of the value from c1 + c2 using some macros.<br>
<br>
Let me know if you have a better solution.<br>
<div><br>
> Question 2:<br>
><br>
> How to use the SCLogDebug and Printf lines to get printed in console? Since<br>
> I couldn't find that. I started using SCLogInfo to print and debug the<br>
> error's.<br>
><br>
> --<br>
> Best Regards,<br>
> Prabhakaran Kasinathan<br>
> <a href="tel:%2B39%203279720502" value="+393279720502" target="_blank">+39 3279720502</a><br>
><br>
><br>
</div>> _______________________________________________<br>
> Oisf-devel mailing list<br>
> <a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@openinfosecfoundation.org</a><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
<br>
doesn't printf print to the console? SCLogDebug needs --enable-debug<br>
while configuring and requires you to set the log-level in the conf<br>
to debug.<br>
<span><font color="#888888"><br>
--<br>
Anoop Saldanha<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br>Best Regards,<br>Prabhakaran Kasinathan<br><a href="tel:%2B39%203279720502" value="+393279720502" target="_blank">+39 3279720502</a><br><br>
</div>