tcpdump filters quiz

Question 1

If the source address begins in byte 12 offset from 0 of an IP header, and the
destination address begins at byte 16, which tcpdump filter could you use to
find records where the source and destination IP addresses are the same?

Answer 1

ip[12:4] = ip[16:4]

Question 2

If the destination address begins in byte 16 offset from 0 in an IP header,
which tcpdump filter would you use to see whether the destination address is
the network address “x.x.x.0”?

Answer 2

ip[19] = 0

Question 3

Given the following set of TCP flags found at the 13th byte of the TCP header,
which tcpdump filter would you use to find TCP records where both the SYN flag
and the FIN flag are set?

|xxx|xxx|URG|ACK|PSH|RST|SYN|FIN|

Answer 3

tcp[13] & 0x02 != 0 and tcp[13] & 0x01 != 0