Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2979 > unrolled thread

identifing tcp codes

Started byHul Tytus <ht@panix.com>
First post2014-06-20 06:35 +0000
Last post2014-06-20 15:46 +0000
Articles 3 — 2 participants

Back to article view | Back to comp.os.linux.networking

Contents

  identifing tcp codes Hul Tytus <ht@panix.com> - 2014-06-20 06:35 +0000
    Re: identifing tcp codes Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2014-06-20 11:48 +0300
      Re: identifing tcp codes Hul Tytus <ht@panix.com> - 2014-06-20 15:46 +0000

#2979 — identifing tcp codes

FromHul Tytus <ht@panix.com>
Date2014-06-20 06:35 +0000
Subjectidentifing tcp codes
Message-ID<lo0knj$8br$1@reader1.panix.com>
comp.os.linux.networking
identifing tcp codes

	I've been looking through several versions of tcp source trying to identify the 2 byte codes in the data sections of some tcp packets. These are typically 0xff 0xfd, 0xff 0xfe, 0xff 0xfb, etc and appear to identify the data segment in some cases and perform some apparantly indepent purpose in others.
	The packets shown below, which show these codes, start with a 4 byte ppp header, then a 5 word (32 bit) ip header. In the second line is the tcp header with the data included. If a byte in the data segment is in the range 0x20 - 0x7? (z), the ascii charactor is shown.
	The last packet shows a minix system sending what I'm guessing to be an announcement of it's "minix" terminal. 0xff 0xf0 is a code for terminal announcements?. 
	Anyone know the common name for these codes, or, even better, where they are identified?

Hul


____________________________________________________________________
  RECIEVE ***		ack push		data included
FF 03 00 21  45 48 00 3A  00 00 40 00  33 06 36 45  A6 54 01 02  48 FB 20 E0 
00 17 80 00  2E 4D 96 3C  01 07 36 D4  50 18 83 2C  37 89 00 00  FF FB 26 FF 
FD 18 FF FD 20 FF FD # FF FD ' FF FD $ 8A 81 
  SEND ***		ack
FF 03 00 21  45 00 00 28  00 05 00 00  40 06 69 9A  48 FB 20 E0  A6 54 01 02 
80 00 00 17  01 07 36 D4  2E 4D 96 4E  50 10 1F EB  02 2A 00 00  2E B5 
  SEND ***		ack push	data included
FF 03 00 21  45 00 00 2B  00 06 00 00  40 06 69 96  48 FB 20 E0  A6 54 01 02 
80 00 00 17  01 07 36 D4  2E 4D 96 4E  50 18 1F EB  DC 1F 00 00  FF FE 26 D5 
AE 
  RECIEVE ***		ack
FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0 
00 17 80 00  2E 4D 96 4E  01 07 36 D4  50 10 83 2C  9E E8 00 00  75 B6 
  RECIEVE ***		ack		to ack or not to ack...
FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0 
00 17 80 00  2E 4D 96 4E  01 07 36 D7  50 10 83 2C  9E E5 00 00  0D 9F 
  SEND ***		ack push		data included
FF 03 00 21  45 00 00 37  00 07 00 00  40 06 69 89  48 FB 20 E0  A6 54 01 02 
80 00 00 17  01 07 36 D7  2E 4D 96 4E  50 18 1F EB  A8 D2 00 00  FF FB 18 FF 
FC 20 FF FC # FF FC ' FF FC $ 1B h 
  RECIEVE ***		ack push		data included
FF 03 00 21  45 48 00 2E  00 00 40 00  33 06 36 51  A6 54 01 02  48 FB 20 E0 
00 17 80 00  2E 4D 96 4E  01 07 36 E6  50 18 83 2C  86 DB 00 00  FF FA 18 01 
FF F0 14 h 
  SEND ***		ack
FF 03 00 21  45 00 00 28  00 08 00 00  40 06 69 97  48 FB 20 E0  A6 54 01 02 
80 00 00 17  01 07 36 E6  2E 4D 96 54  50 10 1F E5  02 18 00 00  22 BC 
  SEND ***		ack push		data included
FF 03 00 21  45 00 00 2C  00 09 00 00  40 06 69 92  48 FB 20 E0  A6 54 01 02 
80 00 00 17  01 07 36 E6  2E 4D 96 54  50 18 1F E5  EA 10 00 00  FF FA 18 00 
A0 ; 
  RECIEVE ***		ack 
FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0 
00 17 80 00  2E 4D 96 54  01 07 36 EA  50 10 83 2C  9E CC 00 00  B5 79 
  SEND ***		ack push		data included
FF 03 00 21  45 00 00 30  00 0A 00 00  40 06 69 8D  48 FB 20 E0  A6 54 01 02 
80 00 00 17  01 07 36 EA  2E 4D 96 54  50 18 1F E5  AE 3F 00 00  m i n i  x 
00 FF F0 E9 ;

[toc] | [next] | [standalone]

#2980

FromTauno Voipio <tauno.voipio@notused.fi.invalid>
Date2014-06-20 11:48 +0300
Message-ID<lo0shc$648$1@dont-email.me>
In reply to#2979
On 20.6.14 09:35, Hul Tytus wrote:
> comp.os.linux.networking
> identifing tcp codes
>
> 	I've been looking through several versions of tcp source trying to identify the 2 byte codes in the data sections of some tcp packets. These are typically 0xff 0xfd, 0xff 0xfe, 0xff 0xfb, etc and appear to identify the data segment in some cases and perform some apparantly indepent purpose in others.
> 	The packets shown below, which show these codes, start with a 4 byte ppp header, then a 5 word (32 bit) ip header. In the second line is the tcp header with the data included. If a byte in the data segment is in the range 0x20 - 0x7? (z), the ascii charactor is shown.
> 	The last packet shows a minix system sending what I'm guessing to be an announcement of it's "minix" terminal. 0xff 0xf0 is a code for terminal announcements?.
> 	Anyone know the common name for these codes, or, even better, where they are identified?
>
> Hul
>
>
> ____________________________________________________________________
>    RECIEVE ***		ack push		data included
> FF 03 00 21  45 48 00 3A  00 00 40 00  33 06 36 45  A6 54 01 02  48 FB 20 E0
> 00 17 80 00  2E 4D 96 3C  01 07 36 D4  50 18 83 2C  37 89 00 00  FF FB 26 FF
> FD 18 FF FD 20 FF FD # FF FD ' FF FD $ 8A 81
>    SEND ***		ack
> FF 03 00 21  45 00 00 28  00 05 00 00  40 06 69 9A  48 FB 20 E0  A6 54 01 02
> 80 00 00 17  01 07 36 D4  2E 4D 96 4E  50 10 1F EB  02 2A 00 00  2E B5
>    SEND ***		ack push	data included
> FF 03 00 21  45 00 00 2B  00 06 00 00  40 06 69 96  48 FB 20 E0  A6 54 01 02
> 80 00 00 17  01 07 36 D4  2E 4D 96 4E  50 18 1F EB  DC 1F 00 00  FF FE 26 D5
> AE
>    RECIEVE ***		ack
> FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0
> 00 17 80 00  2E 4D 96 4E  01 07 36 D4  50 10 83 2C  9E E8 00 00  75 B6
>    RECIEVE ***		ack		to ack or not to ack...
> FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0
> 00 17 80 00  2E 4D 96 4E  01 07 36 D7  50 10 83 2C  9E E5 00 00  0D 9F
>    SEND ***		ack push		data included
> FF 03 00 21  45 00 00 37  00 07 00 00  40 06 69 89  48 FB 20 E0  A6 54 01 02
> 80 00 00 17  01 07 36 D7  2E 4D 96 4E  50 18 1F EB  A8 D2 00 00  FF FB 18 FF
> FC 20 FF FC # FF FC ' FF FC $ 1B h
>    RECIEVE ***		ack push		data included
> FF 03 00 21  45 48 00 2E  00 00 40 00  33 06 36 51  A6 54 01 02  48 FB 20 E0
> 00 17 80 00  2E 4D 96 4E  01 07 36 E6  50 18 83 2C  86 DB 00 00  FF FA 18 01
> FF F0 14 h
>    SEND ***		ack
> FF 03 00 21  45 00 00 28  00 08 00 00  40 06 69 97  48 FB 20 E0  A6 54 01 02
> 80 00 00 17  01 07 36 E6  2E 4D 96 54  50 10 1F E5  02 18 00 00  22 BC
>    SEND ***		ack push		data included
> FF 03 00 21  45 00 00 2C  00 09 00 00  40 06 69 92  48 FB 20 E0  A6 54 01 02
> 80 00 00 17  01 07 36 E6  2E 4D 96 54  50 18 1F E5  EA 10 00 00  FF FA 18 00
> A0 ;
>    RECIEVE ***		ack
> FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0
> 00 17 80 00  2E 4D 96 54  01 07 36 EA  50 10 83 2C  9E CC 00 00  B5 79
>    SEND ***		ack push		data included
> FF 03 00 21  45 00 00 30  00 0A 00 00  40 06 69 8D  48 FB 20 E0  A6 54 01 02
> 80 00 00 17  01 07 36 EA  2E 4D 96 54  50 18 1F E5  AE 3F 00 00  m i n i  x
> 00 FF F0 E9 ;
>

Are you using a Telnet client or server?

The sequences seem to be Telnet control sequences, see
RFC 854 <http://tools.ietf.org/html/rfc854>.

-- 

Tauno Voipio

[toc] | [prev] | [next] | [standalone]

#2981

FromHul Tytus <ht@panix.com>
Date2014-06-20 15:46 +0000
Message-ID<lo1l0b$5v6$1@reader1.panix.com>
In reply to#2980
Tauno - it is indeed telnet. I was anticipating more chit/chat between the 
tcp sections and your pointing to telnet put me on the right track - 
thanks.

Hul

Tauno Voipio <tauno.voipio@notused.fi.invalid> wrote:
> On 20.6.14 09:35, Hul Tytus wrote:
> > comp.os.linux.networking
> > identifing tcp codes
> >
> >       I've been looking through several versions of tcp source trying to identify the 2 byte codes in the data sections of some tcp packets. These are typically 0xff 0xfd, 0xff 0xfe, 0xff 0xfb, etc and appear to identify the data segment in some cases and perform some apparantly indepent purpose in others.
> >       The packets shown below, which show these codes, start with a 4 byte ppp header, then a 5 word (32 bit) ip header. In the second line is the tcp header with the data included. If a byte in the data segment is in the range 0x20 - 0x7? (z), the ascii charactor is shown.
> >       The last packet shows a minix system sending what I'm guessing to be an announcement of it's "minix" terminal. 0xff 0xf0 is a code for terminal announcements?.
> >       Anyone know the common name for these codes, or, even better, where they are identified?
> >
> > Hul
> >
> >
> > ____________________________________________________________________
> >    RECIEVE ***                ack push                data included
> > FF 03 00 21  45 48 00 3A  00 00 40 00  33 06 36 45  A6 54 01 02  48 FB 20 E0
> > 00 17 80 00  2E 4D 96 3C  01 07 36 D4  50 18 83 2C  37 89 00 00  FF FB 26 FF
> > FD 18 FF FD 20 FF FD # FF FD ' FF FD $ 8A 81
> >    SEND ***           ack
> > FF 03 00 21  45 00 00 28  00 05 00 00  40 06 69 9A  48 FB 20 E0  A6 54 01 02
> > 80 00 00 17  01 07 36 D4  2E 4D 96 4E  50 10 1F EB  02 2A 00 00  2E B5
> >    SEND ***           ack push        data included
> > FF 03 00 21  45 00 00 2B  00 06 00 00  40 06 69 96  48 FB 20 E0  A6 54 01 02
> > 80 00 00 17  01 07 36 D4  2E 4D 96 4E  50 18 1F EB  DC 1F 00 00  FF FE 26 D5
> > AE
> >    RECIEVE ***                ack
> > FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0
> > 00 17 80 00  2E 4D 96 4E  01 07 36 D4  50 10 83 2C  9E E8 00 00  75 B6
> >    RECIEVE ***                ack             to ack or not to ack...
> > FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0
> > 00 17 80 00  2E 4D 96 4E  01 07 36 D7  50 10 83 2C  9E E5 00 00  0D 9F
> >    SEND ***           ack push                data included
> > FF 03 00 21  45 00 00 37  00 07 00 00  40 06 69 89  48 FB 20 E0  A6 54 01 02
> > 80 00 00 17  01 07 36 D7  2E 4D 96 4E  50 18 1F EB  A8 D2 00 00  FF FB 18 FF
> > FC 20 FF FC # FF FC ' FF FC $ 1B h
> >    RECIEVE ***                ack push                data included
> > FF 03 00 21  45 48 00 2E  00 00 40 00  33 06 36 51  A6 54 01 02  48 FB 20 E0
> > 00 17 80 00  2E 4D 96 4E  01 07 36 E6  50 18 83 2C  86 DB 00 00  FF FA 18 01
> > FF F0 14 h
> >    SEND ***           ack
> > FF 03 00 21  45 00 00 28  00 08 00 00  40 06 69 97  48 FB 20 E0  A6 54 01 02
> > 80 00 00 17  01 07 36 E6  2E 4D 96 54  50 10 1F E5  02 18 00 00  22 BC
> >    SEND ***           ack push                data included
> > FF 03 00 21  45 00 00 2C  00 09 00 00  40 06 69 92  48 FB 20 E0  A6 54 01 02
> > 80 00 00 17  01 07 36 E6  2E 4D 96 54  50 18 1F E5  EA 10 00 00  FF FA 18 00
> > A0 ;
> >    RECIEVE ***                ack
> > FF 03 00 21  45 48 00 28  00 00 40 00  33 06 36 57  A6 54 01 02  48 FB 20 E0
> > 00 17 80 00  2E 4D 96 54  01 07 36 EA  50 10 83 2C  9E CC 00 00  B5 79
> >    SEND ***           ack push                data included
> > FF 03 00 21  45 00 00 30  00 0A 00 00  40 06 69 8D  48 FB 20 E0  A6 54 01 02
> > 80 00 00 17  01 07 36 EA  2E 4D 96 54  50 18 1F E5  AE 3F 00 00  m i n i  x
> > 00 FF F0 E9 ;
> >

> Are you using a Telnet client or server?

> The sequences seem to be Telnet control sequences, see
> RFC 854 <http://tools.ietf.org/html/rfc854>.

> -- 

> Tauno Voipio

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web