Re: Capture filter help

[Jefferson Ogata <Jefferson.Ogata () noaa gov>]

On 2008-01-17 18:37, Jefferson Ogata wrote:
> To get the next four octets, use:
>
> tcp[((tcp[12:1] & 0xf0) >> 2):4 + 4] = 0xdeadbeef

Sorry, that latter case should have been:

tcp[(((tcp[12:1] & 0xf0) >> 2) + 4):4] = 0xdeadbeef

--
Jefferson Ogata <Jefferson.Ogata () noaa gov>
NOAA Computer Incident Response Team (N-CIRT) <ncirt () noaa gov>
"Never try to retrieve anything from a bear."--National Park Service
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.