Hi all
Can someone help me with this header?
header ip[16:4]
I don’t get it? What does it mean. I have read the manual but was not very helpful
Thx
Moukala.
It means you are reading 4 bytes starting at 16th byte. So if you line this up with your IP header, it matches the destination address in your datagrams.
Sridhar
Research Team wrote:
Hello,
Speaking of pure tcpdump/libpcap definitions, we want to use 4 octets from
position 16 in the ip header.
And in this case, it seems to be the ip destination address.
See http://en.wikipedia.org/wiki/IPv4/Header
Please note taht iounting is done from '0'
With regards,
Jean-philippe.