wrong nlmsg_len?

[Thomas Graf]

On Wed, Jan 25, 2012 at 07:03:18PM +0100, Stijn Souffriau wrote:
>   [ATTR 01] 48 octets
> 14 00 01 00 : CTA_TUPLE_IP  len=20
> 08 00 01 00 : CTA_IP_V4_SRC  len=8
> c0 a8 01 0c
> 08 00 02 00 : CTA_IP_V4_DST  len=8
> c0 a8 01 42
> 1c 00 02 00 : CTA_TUPLE_PROTO len=28
> 05 00 01 00 : CTA_PROTO_NUM  len=8
> 06 00 00 00
> 06 00 02 00 : CTA_PROTO_SRC_PORT  len=8
> da f6 00 00
> 06 00 03 00 : CTA_PROTO_DST_PORT  len=8
> 00 50 00 00
> 
> What and where are these 4 mysterious bytes?

Looking at nfnl_ct_build_tuple(), those 4 bytes you cant account
for belong to the nested attribute header CTA_TUPLE_REPLY or
CTA_TUPLE_ORIG.