tcpdump mailing list archives
Re: Capture filter help
From: Jefferson Ogata <Jefferson.Ogata () noaa gov>
Date: Thu, 17 Jan 2008 20:12:36 +0000
On 2008-01-17 18:37, Jefferson Ogata wrote:
To get the next four octets, use: tcp[((tcp[12:1] & 0xf0) >> 2):4 + 4] = 0xdeadbeef
Sorry, that latter case should have been: tcp[(((tcp[12:1] & 0xf0) >> 2) + 4):4] = 0xdeadbeef -- Jefferson Ogata <Jefferson.Ogata () noaa gov> NOAA Computer Incident Response Team (N-CIRT) <ncirt () noaa gov> "Never try to retrieve anything from a bear."--National Park Service - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Capture filter help Moheed Moheed Ahmad (Jan 17)
- Re: Capture filter help Jefferson Ogata (Jan 17)
- Re: Capture filter help Jefferson Ogata (Jan 17)
- Re: Capture filter help Jefferson Ogata (Jan 17)