when we use a BPF filter, the order in the filter influences the result:
here we have a file (deux_pack.dmp) with only 2 packets with FIN flag
we apply a filter which looks for a specific value in the data ( tcp[20]=0xff ) or a FIN flag
when we do this in this order we obtain no packets after filtering (file test.dmp)
when we first check the flags and then the value (we change the order...
09:20AM UTC on May 24 2007 in The libpcap project
