How to get the from..to offset from tcpdump output to use with iptables string match module
<p>I'm trying to get the 'from' and 'to' offset to use in my iptables rule with the string match module. Here is my output packet from the tcpdump tool:</p>

<pre><code>listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
05:49:49.631211 IP xxx.xxx.xxx.xxx.57625 &gt; xxx.xxx.xxx.xxx.13333: Flags [S],   seq 1036987151, win 29200, options [mss 1460,sackOK,TS val 770422252 ecr 0,nop,wscale 7], length 0
0x0000:  4514 003c 9ee3 4000 3a06 9772 bca5 2e4d  E..&lt;..@.:..r...M
0x0010:  b009 6f56 e119 2f4f 3dcf 2b0f 0000 0000  ..oV../O=.+.....
0x0020:  a002 7210 6e7e 0000 0204 05b4 0402 080a  ..r.n~..........
0x0030:  2deb b5ec 0000 0000 0103 0307            -........... 
</code></pre>

<p>The hex units i'm looking for their start-end position are :</p>

<pre><code>bca5 2e4d b009 6f56
</code></pre>

<p>My aim is to get this iptables rule to work properly: </p>

<pre><code> iptables -A INPUT -p tcp --dport 13333 -m string --from xx --to yy --algo bm --hex-string "|bca52e4db0096f56|" -j DROP
</code></pre>

<p>By the way my rule is already working fine without using the from-to offset.</p>

<p>Any help will be appreciated.
Best regards.</p>