The ToS byte includes 6 bits for the differentiated services code point per RFC2474 and 2 bits for explicit congestion notification, per RFC3168. If you check out RFC791, the second byte of the IP packet is the Type of Service (ToS) byte. Instead, we’ve selected ip, referring to the second byte (offset of 1). If we’d had ip, we’d be interested in the first byte (no offset). Here, we’ve identified the protocol as IP, with an offset of 1. In the PCAP filter language, the bit in brackets defines which part of the protocol you’re interested in.
0 Comments
Leave a Reply. |