signature header

Hi all

Can someone help me with this header?

header ip[16:4]

I don’t get it? What does it mean. I have read the manual but was not very helpful

Thx

Moukala.

It means you are reading 4 bytes starting at 16th byte. So if you line this up with your IP header, it matches the destination address in your datagrams.

Sridhar

Research Team wrote:

Hello,

Speaking of pure tcpdump/libpcap definitions, we want to use 4 octets from
position 16 in the ip header.

And in this case, it seems to be the ip destination address.

See http://en.wikipedia.org/wiki/IPv4/Header

Please note taht iounting is done from '0'

With regards,

Jean-philippe.