0xF0 is just 11110000, and since x & 0 for any bit x is always 0, and x & 1 for any bit x is always x, it follows that the zero bits in 0xF0 will "switch off" or mask the given bits, but leave the rest alone. It's easier to think about this in binary. This is often known as a masking operation, since any bits in the constant set to 0 will also be set to zero in the output. Tcp & 0xf0 takes that Data Offset byte and applies a bitwise AND operation, using the constant 0xF0. This field is only 4 bits, though, and tcp takes a whole byte (8 bits). This field gets its name from the fact that it is also the offset from the start of the TCP segment to the actual data. The minimum size header is 5 words and the maximum is 15 words thus giving the minimum size of 20 bytes and maximum of 60 bytes, allowing for up to 40 bytes of options in the header. Its definition is as follows:ĭata offset (4 bits) specifies the size of the TCP header in 32-bit words. We can see from the structure that offset 12 (0xC) is the Data Offset field. the packet including header) at offset 12. Tcp takes 1 byte of the TCP segment (i.e. Let's deconstruct this into its individual parts: var means c bytes of var starting at offset n, e.g.I presume you pulled this from the "capture HTTP GET requests" filter example.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |