Post B465yGX4HqhuyNhlg0 by ori@hj.9fs.net
 (DIR) More posts by ori@hj.9fs.net
 (DIR) Post #B45ZIYxmAsJXRIGgUK by b0rk@jvns.ca
       0 likes, 1 repeats
       
       worked with the tcpdump folks on an updated set of examples for the tcpdump man page https://www.tcpdump.org/manpages/tcpdump.1.html#lbAFthe idea is that if you've forgotten how tcpdump's basic flags work, you can find a quick reference in the man page!
       
 (DIR) Post #B45ZJAffycPmOA5lYG by rick@a.n0id.space
       0 likes, 0 repeats
       
       @b0rk uhh this is so neat! Thanks!
       
 (DIR) Post #B465yGJx4cDQJhZIES by choomba@social.tchncs.de
       0 likes, 0 repeats
       
       @b0rk or others, is there a page that explains a filter like this: tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)I have no idea what is going on here. This is from the pcap filter man page. Why the masking and shifting and what is up with ip[2:2]? This part of tcpdump has remained a mystery to me for decades.
       
 (DIR) Post #B465yGX4HqhuyNhlg0 by ori@hj.9fs.net
       0 likes, 0 repeats
       
       Checking Wikipedia https://en.wikipedia.org/wiki/IPv4#Header andhttps://en.wikipedia.org/wiki/Transmission_Control_Protocolip[2:2] is the size of the IP packet.((ip[0]&0xf)<<2)) is the size of the IP header((tcp[12]&0xf0)>>2) is the start of data in the tcp packetsSo, this is filtering for tcp packets that have data (is, the TCP data offset is not equal to the end of the IP packet). This is a good example of inspecting packets directly, but definitely needs some additional explanation. Examples should probably not assume a fresh understanding of the protocol header structure.CC: @b0rk@jvns.ca