On Thu, 9 Jul 1998, der Mouse wrote:

> >> #define EBADRPC         72              /* RPC struct is bad */

> > 17:31:21.505909 lechuck.1022 > guybrush.849: udp 80 (ttl 4, id 0)

> This isn't very informative; if there is a problem, it will be with the

True. :) I was pretty tired and not in the best of moods when trying that,
so at the time I didn't even _find_ the -x for tcpdump.

So, let's go for the more informative output:

03:25:57.879659 lechuck.1022 > guybrush.755: udp 80
                         4500 006c 0000 0000 0411 331c c0a8 010b
                         c0a8 010a 03fe 02f3 0058 5bef 0000 0002
                         0000 0000 0000 0002 0001 86ba 0000 0001
                         0000 0002 0000 0001 0000 0014 0000 0000
                         0000 0000 0000 0000 0000 0000 0000 0000
                         0000

First of all, as a newbie to these matters, I can't fully understand this
output. After reading RFC 768 (UDP) I can read out that c0a8 010b c0a8
010a is the IP-numbers 198.168.1.11 and 198.168.1.10 (for lechuck and
guybrush) and 03fe 02f3 are the ports, 0058 would be the length (which
makes me wonder why tcpdump reports 80), 5bef is the checksum and
thereafter comes the data. But this leaves me with the first 12 octets
unaccounted for.

// Magnus Karlsson
  ..
 .OO.  World Wide Wuff: http://tigress.com/emax ; +46-(0)706-615359
 O/\O  @#$%&@#$%&@#$%&@#$%&@#$%&@#$%&@#$%&#$%&@#$%&@#$%&@#$%&@#$%&@
  __                 Qui me amat, amat et canem meam.