Skip to content

Commit

Permalink
remove reserved tcp header flags
Browse files Browse the repository at this point in the history
  • Loading branch information
rscheff committed Mar 28, 2024
1 parent 906e979 commit d61501b
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 12 deletions.
11 changes: 3 additions & 8 deletions pcap-filter.manmisc.in
Original file line number Diff line number Diff line change
Expand Up @@ -1033,12 +1033,7 @@ The following ICMPv6 type field values are available:
The following TCP flags field values are available:
\fBtcp-fin\fP, \fBtcp-syn\fP, \fBtcp-rst\fP,
\fBtcp-push\fP, \fBtcp-ack\fP, \fBtcp-urg\fP,
\fBtcp-ece\fP, \fBtcp-cwr\fP, \fBtcp-ae\fP,
\fBtcp-res1\fP, \fBtcp-res2\fP, \fBtcp-res3\fP and
\fBtcp-res\fP.
Among these, \fBtcp-res\fP is special as it can be
used to check when any of the reserved TCP header
flags is non-zero.
\fBtcp-ece\fP, \fBtcp-cwr\fP, and \fBtcp-ae\fP.
.LP
Primitives may be combined using:
.IP
Expand Down Expand Up @@ -1188,8 +1183,8 @@ The
.B ifindex
keyword became available in libpcap 1.10.0.
.PP
The \fBtcp-ae\fP, \fBtcp-res1\fP, \fBtcp-res2\fP, \fBtcp-res3\fP and \fBtcp-res\fP
became available in libpcap 1.11. Also, \fBtcp[tcpflags]\fP was expanded to allow
The \fBtcp-ae\fP keyword became available in libpcap 1.11.
Also, \fBtcp[tcpflags]\fP was expanded to allow
access to all 12 TCP header flags.
.SH SEE ALSO
.BR pcap (3PCAP)
Expand Down
4 changes: 0 additions & 4 deletions scanner.l
Original file line number Diff line number Diff line change
Expand Up @@ -493,10 +493,6 @@ tcp-urg { yylval->h = 0x20; return NUM; }
tcp-ece { yylval->h = 0x40; return NUM; }
tcp-cwr { yylval->h = 0x80; return NUM; }
tcp-ae { yylval->h = 0x100; return NUM; }
tcp-res3 { yylval->h = 0x200; return NUM; }
tcp-res2 { yylval->h = 0x400; return NUM; }
tcp-res1 { yylval->h = 0x800; return NUM; }
tcp-res { yylval->h = 0xE00; return NUM; }
[A-Za-z0-9]([-_.A-Za-z0-9]*[.A-Za-z0-9])? {
yylval->s = sdup(yyextra, (char *)yytext); return ID; }
"\\"[^ !()\n\t]+ { yylval->s = sdup(yyextra, (char *)yytext + 1); return ID; }
Expand Down

0 comments on commit d61501b

Please sign in to comment.