networking - TCPDUMP: Bitmasking -


i taking digital securities class , dont understand 1 of examples on bitmasking.

to find ipv4 packets run command

tcpdump ip[0] & 0xf0 = 4

i believe wrong, bit mask correctly selects first 4 bits of ip header (which version number) , sets bits internet header length 0.

but shouldnt answer be

tcpdump ip[0] & 0xf0 = 0x40

this states set bits in first byte of ip packet header except first 4 bits (which version number) 0 , show packets value equal 0100 0000

this states set bits in first byte of ip packet header except first 4 bits (which version number) 0

more correctly, selects first 4 bits of first byte of ip packet header, , returns value in lower 4 bits zero.

so are correct, in tcpdump ip[0] & 0xf0 = 4 never succeed (as ip[0] & 0xf0 in range 0x00 through 0xf0, low-order nibble being 0, can never equal 4), , ip[0] & 0xf0 = 0x40 succeed if ip version number in ip header 4 (rather than, example, 6).


Comments

Popular posts from this blog

c# - DetailsView in ASP.Net - How to add another column on the side/add a control in each row? -

javascript - firefox memory leak -

Trying to import CSV file to a SQL Server database using asp.net and c# - can't find what I'm missing -