0

For instance, a WireShark capture filter example I found - tcp[13] & 8 == 8 represents packets with PSH flags.

How do I count the 8 ?

Based on the wikipedia image, enter image description here

PSH is in the middle of the TCP flags segment. Counting 1 from the NS flag, PSH bit representation should be 6 ?

Any guidance is appreciated.

3 Answers 3

0

You should look at tcpdump man page, "Capturing TCP packets with particular flag combinations" section - it's a lots of details here.

0
0

Time to read up on binary arithmetic! To grab the Nth rightmost bit from a byte, you do byte & (1 << N), so the rightmost bit is byte & (n << 0) and the 4th from the right is byte & (n << 3), which is the same as byte << 8.

1
  • Oh the 8 is in terms of binary ? Thanks for the info :)
    – iridescent
    Mar 27, 2013 at 1:49
0

You're also starting to count from the wrong place. NS may be the first flag, but it's also the end bit of byte 12. Byte 13 (as in tcp[13]) starts at bit 8 of line four (labelled "octet 12"), and runs to bit 15 on the same line.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .