how to decode a packet in hex

I submitted this pet earlier, I just wanted some feed back on it and if anyone would, send me any corrections or extra data to input.
http://www.linuxjunior.org/cgi-bin/pet/pet.cgi?SUBMIT=Display&id=93

[pbharris]

hi mountainman,
1st thanks if i did not say it before - the example is easy to follow and gives one a good idea of how to decode a packet, the only issue i saw was when you say an item is a certain color or highlighted i don't see the color/highlighting.


i have a request though which is not related to to this!!
when i see something this:
216.162.197.11/32
or this:
192.168.0.x/24

i think it is meant to cover some range of ip addresses, but don't know exactly what they mean - i think this is basic stuff... anywho an PE explaination of this would be sweet.

[demian]

That's basically the netmask. The number after the slash tells you how many bits of the IP address are fixed. Any ipv4 IP address consists of 32 bits. So the smaller the number after the slash the larger the network you are referring to.

192.168.0.0/24 is a network of 256 IP addresses: 192.168.0.0-192.168.0.255
192.168.0.0/16 contains all the 65536 IP addresses in the range 192.168.0.0-192.168.255.255

From the trailing number you get the number of machines you can have on that network through this formula:

num_of_IPs=2^(32-trailing_number)-1

The final -1 is because you've got to reserve one IP for the broadcast address.

So something like a.b.c.d/32 doesn't really make a lot of sense The smallest net you can have would be one with a /30 netmask with 3 allocatable IP addresses.

[pbharris]

hey thanks again demain!! that makes sense.

the example 216.162.197.11/32 is one i found on another web page. i swear!!

Yeah, I originally had it color codes to make it easier to locate exactly what it was I was talking about, but when I cut and pasted it into the pet file, it lost its color formatting. But, glad you liked it.

[demian]

[quote author=pbharris link=board=23;threadid=6424;start=0#60653 date=1046029088]
the example 216.162.197.11/32 is one i found on another web page. i swear!!
[/quote]

Well thinking about it again. It might actually be legitimate sytanx but the /32 is definitely superfluous. The netmask then says all 32 bits of the IP addresses in the network are fixed and so 216.162.197.11/32 refers to the "net" with only a single IP, namely 216.162.197.11. You then don't need a broadcast address and the above formula wouldn't need the -1 and 2^0 is, after all, 1 meaning the netmask indeed refers to a network of a single computer which doesn't really deserve the term network...
Now the tricky part would be to explain a /31 network which can have 2 IPs. Substract one for the broadcast address you're left with only a single computer again. However, with only one computer you don't need to broadcast anything because no-one will hear you anyway. So can actually have two machines. But wait, you need a broadcast address then,.... ???