Wireshark · Wireshark-users: Re: [Wireshark-users] Hex Offset Needed

[Guy Harris <guy@xxxxxxxxxxxx>]

On Mar 3, 2010, at 6:37 PM, Martin Visser wrote:

> On a serious note, is libpcap able to process that filter efficiently ( I am sure it is much better than using a display filter)

Code generated for Ethernet:

(000) ldh      [16]
(001) jeq      #0x800           jt 2	jf 16
(002) ldb      [27]
(003) jeq      #0x6             jt 4	jf 16
(004) ldh      [24]
(005) jset     #0x1fff          jt 16	jf 6
(006) ldxb     4*([18]&0xf)
(007) ldb      [x + 30]
(008) and      #0xf0
(009) rsh      #2
(010) add      #8
(011) add      x
(012) tax      
(013) ldh      [x + 18]
(014) jeq      #0x2030          jt 15	jf 16
(015) ret      #65535
(016) ret      #0

It's not that bad.  Note, though, that it doesn't handle IPv6.

The IPv4-only code for "tcp port 80" is

(000) ldh      [16]
(001) jeq      #0x800           jt 2	jf 12
(002) ldb      [27]
(003) jeq      #0x6             jt 4	jf 12
(004) ldh      [24]
(005) jset     #0x1fff          jt 12	jf 6
(006) ldxb     4*([18]&0xf)
(007) ldh      [x + 18]
(008) jeq      #0x50            jt 11	jf 9
(009) ldh      [x + 20]
(010) jeq      #0x50            jt 11	jf 12
(011) ret      #65535
(012) ret      #0

so it's only 4 more BPF instructions.