networking - TCPDUMP: Bitmasking -
i taking digital securities class , dont understand 1 of examples on bitmasking.
to find ipv4 packets run command
tcpdump ip[0] & 0xf0 = 4
i believe wrong, bit mask correctly selects first 4 bits of ip header (which version number) , sets bits internet header length 0.
but shouldnt answer be
tcpdump ip[0] & 0xf0 = 0x40
this states set bits in first byte of ip packet header except first 4 bits (which version number) 0 , show packets value equal 0100 0000
this states set bits in first byte of ip packet header except first 4 bits (which version number) 0
more correctly, selects first 4 bits of first byte of ip packet header, , returns value in lower 4 bits zero.
so are correct, in tcpdump ip[0] & 0xf0 = 4
never succeed (as ip[0] & 0xf0
in range 0x00
through 0xf0
, low-order nibble being 0, can never equal 4), , ip[0] & 0xf0 = 0x40
succeed if ip version number in ip header 4 (rather than, example, 6).
Comments
Post a Comment