[Winpcap-users] What do the expressions guarantee to me?

Guy Harris guy at alum.mit.edu
Wed Mar 15 18:52:35 GMT 2006


Ramiro Polla wrote:

> By compiling the expression "ip and (tcp or udp)", what I am guaranteed 
> to have?
> Such as in checksum calculation of ip header, tcp/udp header, and 
> tcp/udp data.
> 
> Does it do any checksum at all,

No.

> or just tells me that the ethernet data 
> (or whatever), has IP set as the protocol, and inside the ip header (or 
> the bytes that would correspond to an ip header) TCP or UDP are set as 
> the protocol?

Yes.


More information about the Winpcap-users mailing list