[tcpdump-workers] Libpcap-1.4.0 BPF_AND not filtering as exected

Guy Harris guy at alum.mit.edu
Thu Nov 6 02:34:33 EST 2014


On Nov 5, 2014, at 10:41 PM, Aparna Nagarajan <aparna.nagarajan26 at gmail.com> wrote:

>> 
>> Hi All,
>> 
>> I am trying to add some BPF code for capture filters.
>> 
>> I am basically trying to load data into accumilator from some offset,
>> Mask it and them match it with some value.
>> 
>> Here is the OPcode:
>> 
>> { 0x20, 0, 0, 0x00000013 }, { 0x54, 0, 0, 0x0ffc0000 }, { 0x15, 0, 1,
>> 0x01000000 }, { 0x6, 0, 0, 0x0000ffff }, { 0x6, 0, 0, 0x00000000 },

Please translate that to BPF assembler language; I'm too busy to translate it myself.



More information about the tcpdump-workers mailing list