Re: tcpdump filter for HTTP GET

[Guy Harris <guy () alum mit edu>]

Robert Lowe wrote:

> Beautiful!  But wouldn't the bit-shift be for 4 bits?

The TCP header length field (data offset field) is in units of 4-byte 
words, not in units of bytes, so it has to be multiplied by 4 to be in 
units of bytes.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.