CRIPTOGRAFIA - FESP

the syntax:
tcpdump "{protocol}[{bypass n bytes}] = {number}"
The available protocols are: ip, tcp, udp, icmp, ether, arp, rarp, and
fddi. What "protocol" refers to is a little murky. If we use "ip" then it
represents the IP header. If we use "icmp" (there is no such thing as an
ICMP header) it represents the payload or data portion of the packet.
An indirect way to capture all icmp traffic is like this:
# tcpdump "ip[9]=1"
This works because the transport protocol is given by the tenth byte of
the IP header. And we know that icmp's protocol number is "1".
Now given that host daffy is currently pinging host spider, the following
command will capture only the echo replies of spider:
# tcpdump -x "icmp[0]=0"
04:20:22.056929 spider > daffy.pmatulis.homeunix.net: icmp: echo reply
4500 0054 c20e 0000 8001 f4db c0a8 0128
c0a8 0146 0000 6354 d87b 0000 3d09 a7a8
000d f46d 0809 0a0b 0c0d 0e0f 1011 1213
1415 1617 1819 1a1b 1c1d 1e1f 2021 2223
2425 2627 2829 2a2b 2c2d 2e2f 3031 3233
3435
Focus your attention on the first 2 digits of chunk 11. That's byte 1 of
the data portion of the packet and it is zero. Well the first byte of an
ICMP message is it's type and by golly type "0" means echo reply.
Let's try that again but this time we'll capture only what we need for
the test (the 14 bytes for the frame header, the first 20 bytes for the IP
header, and 1 byte for the ICMP type). We'll test for echo requests on
the part of daffy this time (echo request is type "8"):
# tcpdump -x -s 35 "icmp[0]=8"
04:56:12.618507 daffy.pmatulis.homeunix.net > spider: [|icmp]
4500 0054 8c8e 0000 ff01 ab5b c0a8 0146
c0a8 0128 08
Pretty good. Exactly as expected.
Something else that's fun is to filter on TCP flags. The key here is to