Decoding IP Headers -- help needed

[Breadfan]

I've got an assignment for one of my classes in which I must decode the IP header of an IP packet, and then display the header, and give some sort of high level description about the packet, such as destination, source, version, checksum, etc.

I'm supposed to either write a program to do this, or write an Excel routine. I'm currently torn between writing a Java app and just doing it in Excel.

In Excel I'm trying to convert my hex dump into binary and decimal. The main problem I'm having is I think to use the HEX2BIN and HEX2DEC commands I can't decode more than a 2 digit hex number. So that would mean I'd need 16 cells to hold the 32bit header. Seems like a pain, especially since soem of the header peices might run from cell to cell.

I'm also having a few problems decoding the ip header itself. I found a resource that shows how to decode the IP header, but they're decoding right off the hex dump! If I convert to decimal, then how will I know what the values are for the various fields?

I referenced from here: http://www.securityhorizon.com/whitepapers/technical/iphead.html

And from RFC 791: ftp://ftp.rfc-editor.org/in-notes/std/std5.txt

So what else can I say? I'm kinda stumped and having trouble getting started. I do know that the first 14 bytes of my captured frame are the part of the ethernetII frame header, than the next 32 bits should be the IP header. Anything after that is the IP payload.

I'd like to just copy the header bits into an Excel cell and have them dynamically converted into decimal and binary in two other cells, with a map showing what bits do what. Then after doing that, i could analyze the readout and determine the details of the packet, such as destiantion, source, etc.

But so far I can't make excel do this easily...looks like using the HEX2BIN and HEX2DEC funcitons will require multiple cells and multiple functions which will just be more time consuming to create and use...

[Breadfan]

OK, hate to reply to my own post, but I just put together some stuff in excel and think I figured a lot of it out.

First, I captured a packet using Ethereal. The only thing I can't figure out there is how to copy the hex dump without retyping it manually. Since he wants the hex dumps in the analysis, I don't want to have to type a full size packet... :eek:

Second, after tossing out the first 14 bytes, I found the IP header is 20 bytes long. Is that correct? Can that vary from packet to pakcet?

One good thing is that the IP header states how long the header will be...after version is basically says header=20 bytes.

By converting those hex values to decimal, it spelled everything out. TTL, packet size, etc. Even the octets from the source and desitnation IP addresses! So I'm nearly set on this.

[XWRed1]

You should convert to decimal only after you've split apart the fields. They are on bit boundaries and so those boundaries wouldn't be apparent if you converted the whole thing to decimal straight away.