On Dec 17, 2008, at 12:18 PM, Matthew Luckie wrote:
could -s become a parameter that takes words as well as numbers, and have the compiler return the appropriate number of bytes in each case?. so -s udphdr -s tcphdr would return 14 + 20 + 8 for UDP packets on ethernet,
Not all link layers have fixed-length headers (consider 802.11) and the IPv4 header isn't guaranteed to be 20 bytes long (options).
and tcphdr would return 14 + 20 + 20 bytes for TCP packets (extra points for snapping tcp options).
If you want to handle TCP (or IP) options, you no longer have a fixed snapshot length, so you'd have to do something along the lines of what I discussed, or pick a snapshot length that's "big enough" for typical packets.
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
