# Error in TCP data length calculation

**URL:** <https://community.zeek.org/t/error-in-tcp-data-length-calculation/1475>\
**Category:** Zeek\
**Created:** [January 9, 2009, 11:07am UTC](https://community.zeek.org/t/error-in-tcp-data-length-calculation/1475 "2009-01-09T11:07:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lothar\_Braun2](https://avatars.discourse-cdn.com/v4/letter/l/b5ac83/32.png) [@Lothar\_Braun2](https://community.zeek.org/u/Lothar_Braun2)\
**Post date:** [January 9, 2009, 11:07am UTC](https://community.zeek.org/t/error-in-tcp-data-length-calculation/1475/1 "2009-01-09T11:07:50Z")

</div>

Hi all,

I tried to access the field tcp\_hdr::dl in one of my bro scripts in  
order to obtain the TCP payload length. But all the values calculated by  
bro seemed to be way too big.

This is due to a missing ntohs() call on the total length field in the  
IP-Header in Session.cc. I attached a patch against bro-1.4 that should  
fix the problem.

Best regards,  
&nbsp;&nbsp;Lothar

[bropatch.diff](https://community.zeek.org/uploads/short-url/zcXu3ofaLOAzoRnDPjjs6iVnjDz.diff) (1.03 KB)

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [January 9, 2009, 4:03pm UTC](https://community.zeek.org/t/error-in-tcp-data-length-calculation/1475/2 "2009-01-09T16:03:08Z")

</div>

Good catch! Can you please file the patch with our tracker  
([tracker.icir.org/bro](http://tracker.icir.org/bro)) so that it don't get lost? Thanks!

Robin

---

<div class="post-metadata">

**Author:** ![Lothar\_Braun2](https://avatars.discourse-cdn.com/v4/letter/l/b5ac83/32.png) [@Lothar\_Braun2](https://community.zeek.org/u/Lothar_Braun2)\
**Post date:** [January 10, 2009, 12:51pm UTC](https://community.zeek.org/t/error-in-tcp-data-length-calculation/1475/3 "2009-01-10T12:51:55Z")

</div>

Hi,

Robin Sommer wrote:

> Good catch! Can you please file the patch with our tracker  
> (tracker.icir.org/bro) so that it don't get lost? Thanks!

oh, I wasn't aware of that tracker. I created ticket #50 and attached  
the patch to it.

Regards,  
&nbsp;&nbsp;Lothar

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [January 10, 2009, 4:29pm UTC](https://community.zeek.org/t/error-in-tcp-data-length-calculation/1475/4 "2009-01-10T16:29:48Z")

</div>

It's new. 🙂 Thanks!

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/error-in-tcp-data-length-calculation/1475/5 "2022-05-06T15:38:50Z")

</div>