From mboxrd@z Thu Jan  1 00:00:00 1970
From: DervishD <lartc@dervishd.net>
Date: Mon, 19 Dec 2005 15:21:36 +0000
Subject: Re: [LARTC] match'ing packets by size
Message-Id: <20051219152136.GB17776@DervishD>
List-Id: <lartc.vger.kernel.org>
References: <20051219104355.6034e25c@pulsar.inexo.com.br>
In-Reply-To: <20051219104355.6034e25c@pulsar.inexo.com.br>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
To: lartc@vger.kernel.org

    Hi Ethy :)

 * Ethy H. Brito <ethy.brito@inexo.com.br> dixit:
> match u16 0x0000 0xffb0 at 2
>=20
> With this match he says that packet with less than 80 bytes will match th=
e rule.

    That's right.
=20
> Well, 0xffb0 translates to 1111 1111 1011 0000 (which is -80 BTW).

    It is a mask, not a number (and certainly not a signed one), so
there's no point in considering it -80. It is just a mask.
=20
> Am I correct or I completely misunderstood it?

    You're right, packet sizes between 16 and 63 (both included)
won't match the rule.

    Ra=FAl N=FA=F1ez de Arenas Coronado

--=20
Linux Registered User 88736 | http://www.dervishd.net
http://www.pleyades.net & http://www.gotesdelluna.net
It's my PC and I'll cry if I want to...
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc