Ask Your Question
0

IPv4 18 Bogus IPv4 version (13, must be 4)

asked 2022-11-15 02:36:51 +0000

suhaspai gravatar image

updated 2022-11-15 03:28:12 +0000

Chuckc gravatar image

Sending the following packet using code

od -t x1 tx.bin
0000000 b4 96 91 ad 8b d0 b4 96 91 ad 8b d0 08 00 de ad
0000020 be ef

tshark -i ens2f0
Capturing on 'ens2f0'
    1 0.000000000 b4:96:91:ad:8b:d0 ?? b4:96:91:ad:8b:d0 **IPv4 18 Bogus IPv4 version (13, must be 4)**

Linux: Ubuntu 20.04.4 LTS Kernel: 5.15.0-50-generic

The port is externally looped back. It works with scapy as shown below: [sudo scapy] >>> sendp("Test", iface="ens2f0") 

tshark -i ens2f0
Capturing on 'ens2f0'
    1 0.000000000 00:00:00:00:00:00 ?? 54:65:73:74:00:00 0x0000 60 Ethernet II
    2 0.000143244 00:00:00:00:00:00 ?? 54:65:73:74:00:00 0x0000 60 Ethernet II

Appreciate pointers to resolve the error.

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-11-15 03:39:11 +0000

Chuckc gravatar image

Add a lowercase -x to your tshark command then look at the byte after the ethernet header bytes (6 + 6 + 2 = 14) (dest, src, type).
If the type is 08 00 (IPv4) then the upper nibble of the next byte is the IP version.
The tshark error **IPv4 18 Bogus IPv4 version (13, must be 4)** is saying 13 (hex d) is not a valid version for IPv4.

edit flag offensive delete link more

Comments

Okay, that was very helpful. So it is treating "d" from "deadbeef" as the version and complaining about it. What should be the ether_type for the code to have worked? I am running it unchanged.

suhaspai gravatar imagesuhaspai ( 2022-11-15 06:00:21 +0000 )edit

That code is about sending a raw Ethernet frame, not about sending an IPv4 packet over Ethernet, even though it pretends to by setting the ether type field to IPv4. You would have to change that code to create a real IPv4 packet in the sendbuf.

Jaap gravatar imageJaap ( 2022-11-15 12:18:05 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2022-11-15 02:36:51 +0000

Seen: 1,417 times

Last updated: Nov 15 '22