CRIPTOGRAFIA - FESP

find where the flags are located in the TCP header. Well, they are found
at byte 14 (we need to bypass 13 bytes). Therefore, we can do the
following if we want to identify all packets containing the RESET flag
(which must necessarily also contains the ACK flag):
# tcpdump -x "tcp[13]=20"
Why? Well first, its actually only the last 6 bits of byte 14 that supply
flag information:
|U|A|P|R|S|F|
|R|C|S|S|Y|I|
|G|K|H|T|N|N|
Therefore ACK and RST gives us a byte of 00010100. I think the first
two bits are always zero (?). Converting binary to decimal (we do not
use hex [which would of been 14 or 0x14]) gives us "20".
Sometimes it may be useful to identify (datagram) fragments. In this
case we filter on fields in the IP header where information regarding
fragmentation is stored. Without elaborating on fragmentation theory,
suffice it to say that if there is no "fragment offset" listed in the IP
header then that packet is either not a fragment or it is the datagram's
very first fragment.
The offset is given by bytes 7 and 8 with the exception of the first 3 bits:
reserved (always zero?), "do not fragment" (DF), and "more fragments
to follow" (MF). Any one datagram will therefore have these two bytes
looking like this:
type bytes 7 and 8
non-fragment 0?00000000000000
first fragment 0010000000000000
intervening
fragment
001xxxxxxxxxxxx
last fragment 000xxxxxxxxxxxx
Where ? may be "1" or "0" and the string of x's contains at least one "1".
So if we can do a bitwise AND operation on those two bytes with the
following binary number then we know our datagram is of the first two
types providing the result is zero:
0001111111111111
So this will sniff non-fragments or "frag zeroes" (initial fragments):