Re: [tcpdump-workers] Multifile patch

2012-09-06 Thread Wesley Shields
On Mon, Sep 03, 2012 at 10:13:57PM -0400, Michael Richardson wrote: > > Wesley, is fopen("/dev/stdin") really the most portal way to > get a reference to stdin? I'd have thought that doing: > VFile=stdin; > > was the best way? I fixed this and your other comment about refactoring reading fr

Re: [tcpdump-workers] Modular arithmetic

2012-09-06 Thread Guy Harris
On Sep 6, 2012, at 12:36 AM, George Bakos wrote: > $ tcpdump -nvr /tmp/DG2-test2 '(ip[2:2] - 20) % 5 != 0 && ip[6] & > 0x20 = 0x20' > > reading from file /tmp/DG2-test2, link-type EN10MB (Ethernet) > 19:01:51.270202 IP (tos 0x0, ttl 64, id 1, offset 40, flags [+], > proto ICMP (1), length 61)

Re: [tcpdump-workers] Modular arithmetic

2012-09-06 Thread George Bakos
Your recommended approach certainly works: $ tcpdump -nvr /tmp/DG2-test2 '((ip[2:2] - 20) - (((ip[2:2] - 20) / 5) * 5)) != 0 && ip[6] & 0x20 = 0x20' reading from file /tmp/DG2-test2, link-type EN10MB (Ethernet) 19:01:51.270202 IP (tos 0x0, ttl 64, id 1, offset 40, flags [+], proto ICMP (1), leng