"Mark I. Williams" <M .
# 12. Layer 2 frame field (position, length)
# 13. Layer 2 field mask.
# This allows truly arbitrary filters to be made. You can match on any part
# of the frame. In fact, with these two items, you can completely specify
# any of the foregoing. It would be the assembler of filter languages.
Not unless your filtering language is interpreted so you can look at a
different byte offset within the frame for fields that follow variable
length fields. Higher-level protocol headers may be at different
locations within a frame depending on whether there are optional or
variable-length fields present in the lower-level protocol headers.
For instance, take a TCP/IP packet in an Ethernet frame. If there are
no IP options specified, then the TCP destination port number will be
in one place in the frame. If any IP options are specified in the IP
header, though, that increases the size of the IP header, and moves
the TCP destination port number further back in the frame.
Brent Chapman Great Circle Associates
COM 1057 West Dana Street
+1 415 962 0841 Mountain View, CA 94041