First, the Mac frame header definition
/* Data frame definition, first 14 bytes, tail 4 bytes */
typedef struct _MAC_FRAME_HEADER {
Char m_cdstmacaddress[6]; Destination MAC Address
Char m_csrcmacaddress[6]; SOURCE MAC Address
Short M_ctype; The previous layer protocol type, such as 0x0800 represents the previous layer is the IP protocol, 0x0806 is ARP
}__ATTRIBUTE__ ((packed)) Mac_frame_header,*pmac_frame_header;
typedef struct _MAC_FRAME_TAIL {
unsigned int m_schecksum; Data frame tail Check and
}__ATTRIBUTE__ ((Packed)) Mac_frame_tail, *pmac_frame_tail;
Second, the definition of IP header structure
/*ip header definition, total 20 bytes */
typedef struct _IP_HEADER {
Char M_cversionandheaderlen; Version information (first 4 bits), head length (last 4 bits)
Char M_ctypeofservice; Service Type 8-bit
Short M_stotallenofpacket; Packet length
Short M_spacketid; Packet identification
Short M_ssliceinfo; Shard usage
Char M_cttl; Survival time
Char M_ctypeofprotocol; Protocol type
Short m_schecksum; Checksum
unsigned int m_uisourip; Source IP
unsigned int m_uidestip; Destination IP
} __attribute__ ((packed)) Ip_header, *pip_header;
Third, TCP header structure definition
/*TCP header definition, total 20 bytes */
typedef struct _TCP_HEADER {
Short M_ssourport; Source Port number 16bit
Short M_sdestport; Destination port number 16bit
unsigned int m_uisequnum; Serial number 32bit
unsigned int m_uiacknowledgenum; Confirmation Number 32bit
Short M_sheaderlenandflag; Top 4 bits: TCP header length, medium 6 bit: reserved, last 6 bits: Flag bit
Short m_swindowsize; Window Size 16bit
Short m_schecksum; Inspection and 16bit
Short M_surgentpointer; Emergency data offset 16bit
}__ATTRIBUTE__ ((Packed)) Tcp_header, *ptcp_header;
Option definitions in the/*TCP header
Kind (8bit) +length (8bit, length of the entire option, including the first two parts) + content (if any)
KIND = 1 means no operation NOP, no back part
2 indicates the length of the maximum segment option after maximum segment (in bytes, 1+1+ content part length)
3 indicates that length after Windows scale is the size of the Windows Scale option (in bytes, 1+1+ content part length)
4 means SACK permitted length is 2, no content part
5 indicates that this is a sack packet length of 2, no content part
8 means timestamp, length 10, timestamp with 8 bytes */
typedef struct _TCP_OPTIONS {
Char M_ckind;
Char m_clength;
Char m_ccontext[32];
}__ATTRIBUTE__ ((Packed)) tcp_options, *ptcp_options;
Iv. definition of UDP header structure
/*UDP header definition, total 8 bytes */
typedef struct _UDP_HEADER {
unsigned short m_ussourport; Source Port number 16bit
unsigned short m_usdestport; Destination port number 16bit
unsigned short m_uslength; Packet length 16bit
unsigned short m_uschecksum; Checksum 16bit
}__ATTRIBUTE__ ((Packed)) Udp_header, *pudp_header;
IP header, TCP header, UDP header, Mac frame header definition