fprintf() and duplicate IP addresses

fprintf() and duplicate IP addresses

[M.Baris Demiray]

[-- Attachment #1: Type: text/plain, Size: 1949 bytes --]


Hello,
I have encountered with a strange problem using fprintf(). I'm
working on a packet sniffer using raw sockets and printing header
details as usual. But when I try to print source and destination IP
addresses, if I use a single fprintf() they're printed as duplicates.
But if I separate them into two fprintf()s everything is OK. Here are
some code snippets and corresponding outputs.

First; with one fprintf():

fprintf(stdout, "%s:%d -> %s:%d  ", \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_src.s_addr), \
         ntohs(tcp_header->source), \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_dst.s_addr), \
         ntohs(tcp_header->dest));

And output after tapping Enter key on a ssh session opened at
10.0.0.50..

TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001

Second; with two fprintf()s:

fprintf(stdout, "%s:%d ", \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_src.s_addr),
         ntohs(tcp_header->source));
fprintf(stdout, "-> %s:%d  ", \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_dst.s_addr),
         ntohs(tcp_header->dest));

And tapping in remote session again.. (Connected from 10.0.0.23)

TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001

That's weird. Missing something?

As extra information; I'm using ip struct in netinet/ip.h and
getting IP header from raw data as below:

         memcpy((struct ip *)ip_header, buffer, SIZE_IP_HDR);

And using gcc-3.2.3 and glibc-2.3.4.

Any idea?

Regards,

-- 
"You have to understand, most of these people are not ready to be
unplugged. And many of them are no inert, so hopelessly dependent
on the system, that they will fight to protect it."
                                                         Morpheus

[-- Attachment #2: baris.vcf --]
[-- Type: text/x-vcard, Size: 342 bytes --]

begin:vcard
fn:M.Baris Demiray
n:Demiray;M.Baris
org:Labris Teknoloji
adr:;;Teknokent Silikon Bina No:24 ODTU;Ankara;;06531;Turkey
email;internet:baris@labristeknoloji.com
title:Yazilim Gelistirme Uzmani
tel;work:+903122101490
tel;fax:+903122101492
x-mozilla-html:FALSE
url:http://www.labristeknoloji.com
version:2.1
end:vcard

Re: fprintf() and duplicate IP addresses

[SVisor]

M.Baris Demiray wrote:

...
> addresses, if I use a single fprintf() they're printed as duplicates.
...
> fprintf(stdout, "%s:%d -> %s:%d  ", \
>         inet_ntoa(*(struct in_addr *)&ip_header->ip_src.s_addr), \
>         ntohs(tcp_header->source), \
>         inet_ntoa(*(struct in_addr *)&ip_header->ip_dst.s_addr), \
>         ntohs(tcp_header->dest));

I have nothing to back my suspection with. But probably inet_ntoa(...) 
uses an internal buffer.

printf( ) solves variables from the right, _before_ adding the result to 
the output (only the "pointer" to char* is saved), you only get the 
result from the first one (as they "point" to same memory).

// Jarmo

Re: fprintf() and duplicate IP addresses

[mikael-aronsson]

That's correct, most implementations use a static buffer, even though most 
modern applications has a separate buffer for each thread.

Mikael

----- Original Message ----- 
From: "SVisor" <svisor@lycos.com>
To: <linux-c-programming@vger.kernel.org>
Sent: Tuesday, May 31, 2005 8:28 AM
Subject: Re: fprintf() and duplicate IP addresses


> M.Baris Demiray wrote:
>
> ...
>> addresses, if I use a single fprintf() they're printed as duplicates.
> ...
>> fprintf(stdout, "%s:%d -> %s:%d  ", \
>>         inet_ntoa(*(struct in_addr *)&ip_header->ip_src.s_addr), \
>>         ntohs(tcp_header->source), \
>>         inet_ntoa(*(struct in_addr *)&ip_header->ip_dst.s_addr), \
>>         ntohs(tcp_header->dest));
>
> I have nothing to back my suspection with. But probably inet_ntoa(...) 
> uses an internal buffer.
>
> printf( ) solves variables from the right, _before_ adding the result to 
> the output (only the "pointer" to char* is saved), you only get the result 
> from the first one (as they "point" to same memory).
>
> // Jarmo
>
> -
> To unsubscribe from this list: send the line "unsubscribe 
> linux-c-programming" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html 

Re: fprintf() and duplicate IP addresses

[M.Baris Demiray]

[-- Attachment #1: Type: text/plain, Size: 1309 bytes --]


Hello again,
Thanks for the comments Mikael and Jarmo. As you said, the problem was
caused by the usage of static buffers in inet_ntoa() and fprintf() was
innocent at all. Since only the char * values are saved in fprintf(),
every inet_ntoa() overwrites the previous' values.

This was also written in man page (argh!):
"The string is returned in a statically allocated buffer, which
  subsequent  calls  will  overwrite."

I think I didn't searched enough to see that this is a common problem.

Everything is more clear now, thanks.

mikael-aronsson wrote:
> That's correct, most implementations use a static buffer, even though 
> most modern applications has a separate buffer for each thread.
> 
> Mikael

 > [...]

>> I have nothing to back my suspection with. But probably inet_ntoa(...) 
>> uses an internal buffer.
>>
>> printf( ) solves variables from the right, _before_ adding the result 
>> to the output (only the "pointer" to char* is saved), you only get the 
>> result from the first one (as they "point" to same memory).
>>
>> // Jarmo

-- 
"You have to understand, most of these people are not ready to be
unplugged. And many of them are no inert, so hopelessly dependent
on the system, that they will fight to protect it."
                                                         Morpheus

[-- Attachment #2: baris.vcf --]
[-- Type: text/x-vcard, Size: 342 bytes --]

begin:vcard
fn:M.Baris Demiray
n:Demiray;M.Baris
org:Labris Teknoloji
adr:;;Teknokent Silikon Bina No:24 ODTU;Ankara;;06531;Turkey
email;internet:baris@labristeknoloji.com
title:Yazilim Gelistirme Uzmani
tel;work:+903122101490
tel;fax:+903122101492
x-mozilla-html:FALSE
url:http://www.labristeknoloji.com
version:2.1
end:vcard