Hi Charles, 1. tcp_dport == 3200:7 is wrong Use tcp_dport:7 = 3200 2. To see bit manipulation in tcng: /usr/lib/tcng/include/ fields4.tc:field tcp_SYN = (tcp_hdr[13].b >> 1) & 1; /* SYN */ idiomatic.tc:field ip_tos_throughput = (ip_tos >> 3) & 1; - Jacob Message: 7 From: "lartc@xxxxxxxxxxxxxxxxxxx" <lartc@xxxxxxxxxxxxxxxxxxx> To: LARTC list <lartc@xxxxxxxxxxxxxxx> Date: Tue, 02 Dec 2003 18:36:13 +0100 Subject: port masks in tcng hi all, hopefully a simple question: i would like to have a range of ports from 3200 to 3299, so i did the standard calculation 65535 - ( 3299 - 3200 ) = 65436 = 0xff9c what is the syntax for a hex mask in tcng? for the moment, i have <snip> (<$high>) if tcp_dport == 3200:7; <snip> which gives me a wee bit too much thanks! cheers charles _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/