Using the socket BPF

Using the socket BPF

Note (the content described in this article):

In addition, the problem with this BPF code is that, in general, tcpdump only returns the first 96 bytes of the captured packet, which is the 0x60 byte, and the second-to-last line of the visible code is the RET #96. For a complete package processing or not, so you need to set it to 0x0000ffff, or when using tcpdump generated with Tcpdump-s 65535-dd ... To generate

1, my tcpdump generated BPF code, the length is directly 0x0000ffff rather than 0x60, may be related to the tcpdump version

[[Email Protected] NFS] #/tcpdump UDP-DD device eth0 entered promiscuous mode{0x28, 0, 0, 0x0000000cdevice eth0 left P romiscuous mode},{0x15, 0, 5, 0x000086dd},{0x30, 0, 0, 0x00000014},{0x15, 6, 0, 0x00000011},{0x15, 0, 6, 0x0000002  C},{0x30, 0, 0, 0x00000036},{0x15, 3, 4, 0x00000011},{0x15, 0, 3, 0x00000800},{0x30, 0, 0, 0x00000017},{0x15, 0, 1, 0x00000011},{0x6, 0, 0, 0x0000ffff},{0x6, 0, 0, 0x00000000},[[email protected] NFS] #./TCPDUMP-DD ether Proto 0 X8033device Eth0 entered promiscuous mode{0x28, 0, 0, 0xdevice eth0 left promiscuous mode0000000c},{0x15, 0, 1, 0x00008 033},{0x6, 0, 0, 0x0000ffff},{0x6, 0, 0, 0x00000000},[[email protected] NFS] #./tcpdump--help                ./tcpdump:invali d option---tcpdump version 4.5.1libpcap version 1.5.2

BPF (BSD Packet Filter)-Application and concept extensions

Using socket BPF