Before using the nids caught, it is already have user data pointer. But now with the pcap capture the packet data address to find their own, and then found in removing the etheric, IP, the head of the TCP agreement after 14 + 20 + 20 + 12 again is the actual user data; What is that between the 12 bytes of data, this data is the first agreement, baidu along while didn't explain in this respect, Orz

CodePudding user response:

Should be the MAC address

CodePudding user response:

reference 1st floor NJSRLB response:

should be the MAC address

==is tried, like head started the MAC address of the message,, why put a more,,,

CodePudding user response:

reference 1st floor NJSRLB response:

should be the MAC address

, then look at the down is not the same as the beginning of the MAC, and this is because the MAC is a subnet?

CodePudding user response:

MAC, you know...