1

I am analysing packets being sent from an MT4000 telemetry device. I have set up a listener in the terminal(Linux) and set to display the packets being received in hex.

So far the packet incoming looks like this :

10:57:54.973363 IP 31.70.199.41.30000 > Dans-iPod.30000: UDP, length 37
0x0000:  0019 216b a7b2 0018 3f49 8ac1 0800 4568  ..!k....?I....Eh
0x0010:  0041 007a 0000 ed11 245c 1f46 c729 c0a8  .A.z....$\.F.)..
0x0020:  0156 7530 7530 002d c20f 000a 0200 2020  .Vu0u0.-........
0x0030:  2020 2020 2020 2031 2020 2020 2020 2030  .......1.......0
0x0040:  3132 3938 3130 3030 3239 3832 3133 20    12981000298213.

Using this chart from the MT4000 reference guide, I tried matching up the hex to the correct uses.

*I'm unable to post the image as I don't have 10 reputation yet. You can find the breakdown of the UDP packet on the MT4000 API reference guide, or I think just a standard UDP packet breakdown.

The guide suggests that Byte 0 should contain an "8-bit field for version and length. This API only supports version 4 with IP header length of 5*4=20 bytes. This field must be set to 0x45.2"

Using this information, I can see that the version byte number 15, instead of 0. Everything after this matches up, but I can't find an explanation for the first 14 bytes : 0019 216b a7b2 0018 3f49 8ac1 0800

Any help would be very much appreciated, thanks in advance,

Ed

Ed Prince
  • 285

1 Answers1

3

The 14 bytes in front of the IP header are the Ethernet header, the last two bytes of which (0800) indicate the higher layer protocol (IP).

JyrgenN
  • 141