%PDF- <> %âãÏÓ endobj 2 0 obj <> endobj 3 0 obj <>/ExtGState<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 28 0 R 29 0 R] /MediaBox[ 0 0 595.5 842.25] /Contents 4 0 R/Group<>/Tabs/S>> endobj ºaâÚÎΞ-ÌE1ÍØÄ÷{òò2ÿ ÛÖ^ÔÀá TÎ{¦?§®¥kuµùÕ5sLOšuY>endobj 2 0 obj<>endobj 2 0 obj<>endobj 2 0 obj<>endobj 2 0 obj<> endobj 2 0 obj<>endobj 2 0 obj<>es 3 0 R>> endobj 2 0 obj<> ox[ 0.000000 0.000000 609.600000 935.600000]/Fi endobj 3 0 obj<> endobj 7 1 obj<>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI]>>/Subtype/Form>> stream
# # Location definitions for packet matching # # name alignment offset mask shift ip.version u8 net+0 0xF0 4 ip.hdrlen u8 net+0 0x0F ip.diffserv u8 net+1 ip.length u16 net+2 ip.id u16 net+4 ip.flag.res u8 net+6 0xff 7 ip.df u8 net+6 0x40 6 ip.mf u8 net+6 0x20 5 ip.offset u16 net+6 0x1FFF ip.ttl u8 net+8 ip.proto u8 net+9 ip.chksum u16 net+10 ip.src u32 net+12 ip.dst u32 net+16 # if ip.ihl > 5 ip.opts u32 net+20 # # IP version 6 # # name alignment offset mask shift ip6.version u8 net+0 0xF0 4 ip6.tc u16 net+0 0xFF0 4 ip6.flowlabel u32 net+0 0xFFFFF ip6.length u16 net+4 ip6.nexthdr u8 net+6 ip6.hoplimit u8 net+7 ip6.src 16 net+8 ip6.dst 16 net+24 # # Transmission Control Protocol (TCP) # # name alignment offset mask shift tcp.sport u16 tcp+0 tcp.dport u16 tcp+2 tcp.seq u32 tcp+4 tcp.ack u32 tcp+8 # Data offset (4 bits) tcp.off u8 tcp+12 0xF0 4 # Reserved [0 0 0] (3 bits) tcp.reserved u8 tcp+12 0x04 1 # ECN [N C E] (3 bits) tcp.ecn u16 tcp+12 0x01C00 6 # Individual TCP flags (0|1) (6 bits in total) tcp.flag.urg u8 tcp+13 0x20 5 tcp.flag.ack u8 tcp+13 0x10 4 tcp.flag.psh u8 tcp+13 0x08 3 tcp.flag.rst u8 tcp+13 0x04 2 tcp.flag.syn u8 tcp+13 0x02 1 tcp.flag.fin u8 tcp+13 0x01 tcp.win u16 tcp+14 tcp.csum u16 tcp+16 tcp.urg u16 tcp+18 tcp.opts u32 tcp+20 # # User Datagram Protocol (UDP) # # name alignment offset mask shift udp.sport u16 tcp+0 udp.dport u16 tcp+2 udp.length u16 tcp+4 udp.csum u16 tcp+6