SCTP protocol has the following format of packages: - Source Port Number - Destination Port Number - Verification Tag - Checksum - N chunks
I'm trying to write low-lever parser of the protocol, but I don't know, how to determine number of chunks in the SCTP package. Thanks!
You need to parse the chunk headers. Each one contains a 16-bit length field, after the 8-bit type & 8-bit flags fields. Remember that all numeric values in SCTP are in network byte order (big-endian).
The chunk fields are documented in RFC 4960 section 3.2:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk Type | Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Chunk Value /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Chunks begin after the SCTP Common Header Field Descriptions.
By reading the Chunk Length field you can skip its payload and find the start of the next chunk. Do this repeatedly until you reach the end of the IP packet.
The chunk's length includes the four bytes that constitute the type, flags & length fields.