IPv4 18 Bogus IPv4 version (13, must be 4)

asked 2022-11-15 02:36:51 +0000

updated 2022-11-15 03:28:12 +0000

Chuckc
2858 ●5 ●568 ●19

Sending the following packet using code

od -t x1 tx.bin
0000000 b4 96 91 ad 8b d0 b4 96 91 ad 8b d0 08 00 de ad
0000020 be ef

tshark -i ens2f0
Capturing on 'ens2f0'
    1 0.000000000 b4:96:91:ad:8b:d0 ?? b4:96:91:ad:8b:d0 **IPv4 18 Bogus IPv4 version (13, must be 4)**

Linux: Ubuntu 20.04.4 LTS Kernel: 5.15.0-50-generic

The port is externally looped back. It works with scapy as shown below: [sudo scapy] >>> sendp("Test", iface="ens2f0")

tshark -i ens2f0
Capturing on 'ens2f0'
    1 0.000000000 00:00:00:00:00:00 ?? 54:65:73:74:00:00 0x0000 60 Ethernet II
    2 0.000143244 00:00:00:00:00:00 ?? 54:65:73:74:00:00 0x0000 60 Ethernet II

Appreciate pointers to resolve the error.

answered 2022-11-15 03:39:11 +0000

Chuckc
2858 ●5 ●568 ●19

Add a lowercase -x to your tshark command then look at the byte after the ethernet header bytes (6 + 6 + 2 = 14) (dest, src, type).
If the type is 08 00 (IPv4) then the upper nibble of the next byte is the IP version.
The tshark error **IPv4 18 Bogus IPv4 version (13, must be 4)** is saying 13 (hex d) is not a valid version for IPv4.

edit flag offensive delete link

Comments

Okay, that was very helpful. So it is treating "d" from "deadbeef" as the version and complaining about it. What should be the ether_type for the code to have worked? I am running it unchanged.

suhaspai ( 2022-11-15 06:00:21 +0000 )edit

That code is about sending a raw Ethernet frame, not about sending an IPv4 packet over Ethernet, even though it pretends to by setting the ether type field to IPv4. You would have to change that code to create a real IPv4 packet in the sendbuf.

Jaap ( 2022-11-15 12:18:05 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

IPv4 18 Bogus IPv4 version (13, must be 4)

1 Answer

Comments

Your Answer

Question Tools

Stats

IPv4 18 Bogus IPv4 version (13, must be 4) edit

1 Answer

Comments

Your Answer

Question Tools

Stats

IPv4 18 Bogus IPv4 version (13, must be 4)