负TCP序列号（C，LibPcap，TCP）

Question

I'm working with libpcap and having trouble accessing the sequence number variable from this struct.

To get the TCP sequence number i'm now using ntohl(tcp->th_seq) and it gives me some sequence numbers in the positive and they seem to be valid (in wireshark) but it's also giving me a lot of negative TCP numbers.

Am I accessing the variable wrong or do the negative TCP numbers need to be converted some how?

struct sniff_tcp *tcp;

typedef u_int tcp_seq;

struct sniff_tcp {
    u_short th_sport;               /* source port */
    u_short th_dport;               /* destination port */
    tcp_seq th_seq;                 /* sequence number */
    tcp_seq th_ack;                 /* acknowledgement number */
    u_char  th_offx2;               /* data offset, rsvd */
    #define TH_OFF(th)      (((th)->th_offx2 & 0xf0) >> 4)
    u_char  th_flags;
    #define TH_FIN  0x01
    #define TH_SYN  0x02
    #define TH_RST  0x04
    #define TH_PUSH 0x08
    #define TH_ACK  0x10
    #define TH_URG  0x20
    #define TH_ECE  0x40
    #define TH_CWR  0x80
    #define TH_FLAGS        (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
    u_short th_win;                 /* window */
    u_short th_sum;                 /* checksum */
    u_short th_urp;                 /* urgent pointer */
};

-----Console:-----------------------------------
Packet number 24:
current time: 2015-04-10 14:14:48.990 
   From: x.x.x.x
     To: y.y.y.y
   Protocol: TCP
   Src port: 443
   Dst port: 53111
    Seq Num: 943553986  // This is valid in wireshark
   ACK Detected

Packet number 25:
current time: 2015-04-10 14:14:48.990 
   From: x.x.x.x
     To: y.y.y.y
   Protocol: TCP
   Src port: 53111
   Dst port: 443
    Seq Num: -1759841006  // I'm not sure what to make of this
   ACK Detected

Answer 1

You're not showing how you print the number. Probably you're just printing using the wrong format specifier. The number returned by ntohl() is of type uint32_t so it must be printed like this:

#include <inttypes.h>

printf("%" PRIu32, ntohl(tcp->th_seq));

Here PRIu32 is the proper format specifier for your platform to print a 32-bit unsigned integer.