First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

IPv4 18 Bogus IPv4 version (13, must be 4)

  • retag add tags

Sending the following packet using code

od -t x1 tx.bin
0000000 b4 96 91 ad 8b d0 b4 96 91 ad 8b d0 08 00 de ad
0000020 be ef

tshark -i ens2f0
Capturing on 'ens2f0'
    1 0.000000000 b4:96:91:ad:8b:d0 ?? b4:96:91:ad:8b:d0 **IPv4 18 Bogus IPv4 version (13, must be 4)**

Linux: Ubuntu 20.04.4 LTS Kernel: 5.15.0-50-generic

The port is externally looped back. It works with scapy as shown below: [sudo scapy] >>> sendp("Test", iface="ens2f0") 

tshark -i ens2f0
Capturing on 'ens2f0'
    1 0.000000000 00:00:00:00:00:00 ?? 54:65:73:74:00:00 0x0000 60 Ethernet II
    2 0.000143244 00:00:00:00:00:00 ?? 54:65:73:74:00:00 0x0000 60 Ethernet II

Appreciate pointers to resolve the error.

suhaspai's avatar
1
suhaspai
asked 2022-11-15 02:36:51 +0000
Chuckc's avatar
3k
Chuckc
updated 2022-11-15 03:28:12 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Add a lowercase -x to your tshark command then look at the byte after the ethernet header bytes (6 + 6 + 2 = 14) (dest, src, type).
If the type is 08 00 (IPv4) then the upper nibble of the next byte is the IP version.
The tshark error **IPv4 18 Bogus IPv4 version (13, must be 4)** is saying 13 (hex d) is not a valid version for IPv4.

Chuckc's avatar
3k
Chuckc
answered 2022-11-15 03:39:11 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Okay, that was very helpful. So it is treating "d" from "deadbeef" as the version and complaining about it. What should be the ether_type for the code to have worked? I am running it unchanged.

suhaspai's avatar suhaspai (2022-11-15 06:00:21 +0000) edit
more
  • delete

That code is about sending a raw Ethernet frame, not about sending an IPv4 packet over Ethernet, even though it pretends to by setting the ether type field to IPv4. You would have to change that code to create a real IPv4 packet in the sendbuf.

Jaap's avatar Jaap (2022-11-15 12:18:05 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer