NETWORKING - Hacking: The Art of Exploitation - page 234

| Data | |U|A|P|R|S|F| |
| Offset| Reserved |R|C|S|S|Y|I| Window |
| | |G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Data Offset: 4 bits
The number of 32 bit words in the TCP Header. This indicates where
the data begins. The TCP header (even one including options) is an
integral number of 32 bits long.
Reserved: 6 bits
Reserved for future use. Must be zero.
Options: variable
Linux's tcphdr structure also switches the ordering of the 4-bit data offset
field and the 4-bit section of the reserved field depending on the host's byte
order. The data offset field is important, since it tells the size of the variable-
length TCP header. You might have noticed that Linux's tcphdr structure
doesn't save any space for TCP options. This is because the RFC defines this
field as optional. The size of the TCP header will always be 32-bit-aligned, and
the data offset tells us how many 32-bit words are in the header. So the TCP
header size in bytes equals the data offset field from the header times four.
Since the data offset field is required to calculate the header size, we'll split
the byte containing it, assuming little-endian host byte ordering.
The th_flags field of Linux's tcphdr structure is defined as an 8-bit unsigned
character. The values defined below this field are the bitmasks that correspond
to the six possible flags.
Added to hacking-network.h
struct tcp_hdr {
unsigned short tcp_src_port; // Source TCP port
unsigned short tcp_dest_port; // Destination TCP port
unsigned int tcp_seq; // TCP sequence number
unsigned int tcp_ack; // TCP acknowledgment number
unsigned char reserved:4; // 4 bits from the 6 bits of reserved space
unsigned char tcp_offset:4; // TCP data offset for little-endian host
unsigned char tcp_flags; // TCP flags (and 2 bits from reserved space)
#define TCP_FIN 0x01
#define TCP_SYN 0x02
#define TCP_RST 0x04
#define TCP_PUSH 0x08
#define TCP_ACK 0x10
#define TCP_URG 0x20
unsigned short tcp_window; // TCP window size
unsigned short tcp_checksum; // TCP checksum
unsigned short tcp_urgent; // TCP urgent pointer
};