title: Negative TCP Sequence Numbers (C, LibPcap, TCP)
body: <p>I'm working with libpcap and having trouble accessing the sequence number variable from this struct. </p>
  
  <p>To get the TCP sequence number i'm now using <code>ntohl(tcp-&gt;th_seq)</code> and it gives me some sequence numbers in the positive and they seem to be valid (in wireshark) but it's also giving me a lot of negative TCP numbers. </p>
  
  <p>Am I accessing the variable wrong or do the negative TCP numbers need to be converted some how?</p>
  
  <pre><code>struct sniff_tcp *tcp;
  
  typedef u_int tcp_seq;
  
  struct sniff_tcp {
      u_short th_sport;               /* source port */
      u_short th_dport;               /* destination port */
      tcp_seq th_seq;                 /* sequence number */
      tcp_seq th_ack;                 /* acknowledgement number */
      u_char  th_offx2;               /* data offset, rsvd */
      #define TH_OFF(th)      (((th)-&gt;th_offx2 &amp; 0xf0) &gt;&gt; 4)
      u_char  th_flags;
      #define TH_FIN  0x01
      #define TH_SYN  0x02
      #define TH_RST  0x04
      #define TH_PUSH 0x08
      #define TH_ACK  0x10
      #define TH_URG  0x20
      #define TH_ECE  0x40
      #define TH_CWR  0x80
      #define TH_FLAGS        (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
      u_short th_win;                 /* window */
      u_short th_sum;                 /* checksum */
      u_short th_urp;                 /* urgent pointer */
  };
  
  -----Console:-----------------------------------
  Packet number 24:
  current time: 2015-04-10 14:14:48.990 
     From: x.x.x.x
       To: y.y.y.y
     Protocol: TCP
     Src port: 443
     Dst port: 53111
      Seq Num: 943553986  // This is valid in wireshark
     ACK Detected
  
  Packet number 25:
  current time: 2015-04-10 14:14:48.990 
     From: x.x.x.x
       To: y.y.y.y
     Protocol: TCP
     Src port: 53111
     Dst port: 443
      Seq Num: -1759841006  // I'm not sure what to make of this
     ACK Detected
  </code></pre>