Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
I am learning tcpdump recently, but I have some troubles now. I have already search them in google and there is nothing can help me solve my problem. If you know the answer, please help me. Thank you very much.
I want to know the expressions' meanings, the following are what make me confused:
ip[0]&0xf)<<2
tcp[12]&0xf0)>>2
ip[2:2]
tcp[20:2]=0x4745 or tcp[20:2]=0x4854
A packet is fundamentally just an array of bytes, and the [...] syntax is commonly used for array indexing (accessing specific elements or element ranges) in most programming languages.
tcpdump's (libpcap) filter syntax is documented in the pcap-filter(7) manual page, where you'll find:
To access data inside the packet, use the following syntax:
proto [ expr : size ]
For example, tcp[20:2] refers to 2 bytes 20–21 from the TCP segment (counting from 0), and according to the TCP header documentation, these usually mean the first two bytes of the segment's data payload (although they might also be the first two bytes of a TCP option).
(0x4745 is "GE" in ASCII, so tcp[20:2]=0x4745 most likely acts as a rough filter for HTTP GET requests.)
