fprintf() and duplicate IP addresses

["M.Baris Demiray" <baris@labristeknoloji.com>]

[-- Attachment #1: Type: text/plain, Size: 1949 bytes --]


Hello,
I have encountered with a strange problem using fprintf(). I'm
working on a packet sniffer using raw sockets and printing header
details as usual. But when I try to print source and destination IP
addresses, if I use a single fprintf() they're printed as duplicates.
But if I separate them into two fprintf()s everything is OK. Here are
some code snippets and corresponding outputs.

First; with one fprintf():

fprintf(stdout, "%s:%d -> %s:%d  ", \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_src.s_addr), \
         ntohs(tcp_header->source), \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_dst.s_addr), \
         ntohs(tcp_header->dest));

And output after tapping Enter key on a ssh session opened at
10.0.0.50..

TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.50:34001

Second; with two fprintf()s:

fprintf(stdout, "%s:%d ", \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_src.s_addr),
         ntohs(tcp_header->source));
fprintf(stdout, "-> %s:%d  ", \
         inet_ntoa(*(struct in_addr *)&ip_header->ip_dst.s_addr),
         ntohs(tcp_header->dest));

And tapping in remote session again.. (Connected from 10.0.0.23)

TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001
TCP IPv4 10.0.0.50:22 -> 10.0.0.23:34001

That's weird. Missing something?

As extra information; I'm using ip struct in netinet/ip.h and
getting IP header from raw data as below:

         memcpy((struct ip *)ip_header, buffer, SIZE_IP_HDR);

And using gcc-3.2.3 and glibc-2.3.4.

Any idea?

Regards,

-- 
"You have to understand, most of these people are not ready to be
unplugged. And many of them are no inert, so hopelessly dependent
on the system, that they will fight to protect it."
                                                         Morpheus

[-- Attachment #2: baris.vcf --]
[-- Type: text/x-vcard, Size: 342 bytes --]

begin:vcard
fn:M.Baris Demiray
n:Demiray;M.Baris
org:Labris Teknoloji
adr:;;Teknokent Silikon Bina No:24 ODTU;Ankara;;06531;Turkey
email;internet:baris@labristeknoloji.com
title:Yazilim Gelistirme Uzmani
tel;work:+903122101490
tel;fax:+903122101492
x-mozilla-html:FALSE
url:http://www.labristeknoloji.com
version:2.1
end:vcard