How to determine the starting byte of http header in a raw packet?

Question

I am developing a networking application in C. I have the fields and starting byte of the ethernet header, IPV4 header and TCP header. How to get the starting byte (pointer) to the HTTP header?

Edit:

I made a mistake while initializing the pointer for the HTTP header. I was doing it wrong here:

//tcp_header is a pointer to a structure of TCP header
char *data = (char *) (tcp_header + tcp_header_length);

I corrected it to

char *data = (char *) tcp_header + tcp_header_length;

and everything is peachy now :) Thanks for the help.

Answer 1

It depends on the type of interface you are using to obtain the datagrams. You are probably using socket interface. You can also use pcap. If you use socekts, it depends on the type of socket you use:

• Packet Sockets: you can directly obtain an Ethernet frame
• Raw Sockets: you can read IP datagrams (with or without IP header)
• Datagram or Stream Sockets: you can read UDP or TCP payloads

If you have the whole Ethernet frame, @thurizas, gave you most important hints and I can add:

• The Ethernet frame will have 14-Octet (Byte in Networking language) length: 1-Destination address, 2-Source addres, 3-Ether type or Length

In Ethernet frame you need to consider:

• If the last 2 octets are >= 1536, the most typical case, it is Ethertype. You will see value 0x0800 when IP datagrams are conveyed in the frame payload. In this case after 0x0800, you have the whole IP datagram.

• If the last 2 octets are <=1500, it indicates the payload length. It could contain an 802.2 LLC frame.

• If you work with VLAN and those 2 octets are 0x8100, then you have to consider 4 octets of 802.1Q tag and then 2 Octets for Ethertype/Length

In the IP header you need to consider two fields:

• The second nibble (the last 4 bits of the first Byte, Byte 0) gives you the header length in groups of 4 Bytes
• Bytes 2 and 3 give the total length of the IP datagram including header. You need to calculate ((Total Length) - (IHL x 4)) to obain total IP payload length

If the IP datagram contains a TCP header, the total length is the IP payload length.

At TCP layer, I cannot add anything to what @thurizas wrote. Just, assuming SSL/TLS is not used, the next Byte following TCP header will be the first Byte of HTTP.