Help the Newbies

[Mac]

Thank you Edwin !

[Edwin Groothuis]

The ip[] thingie takes the 40th byte from the beginning of the IP header and compares is it 0x01010101.

If the packet is a GRE encapsulated, that is the location of the original source IP address.

Edwin

[Mac]

Hi,

Can someone help me with the following:

1. I saw this part in a tcpdump filter:

((ip[40:4] = 0x01010101 and ip[44:4] = 0x02020202 ) or (ip[40:4] = 0x02020202 and ip[44:4] = 0x01010101 ))

Can someone please help me to interpret the meaning of the above lines.

2. Can someone share to me a document or url where I can gain better undertanding on how to create tcpdump filter from simple to complex.

Thank you in advance !