Hello list, Is it possible to select the last 8 bytes of a HEX string using the "string" module? Purpose: I want to create a "DNS ANY query" recent-filter (tons of these queries from China). The last 8 bytes of such a query seem to be: 00 FF 00 01 but AFAIU the manpage I can't use the --to and --from offset settings as the length of the packet is variable. Anyone another solution to block these queries? R. -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | | Public key and email address: | | http://www.lucassen.org/mail-pubkey.html | +------------------------------------------------------------------+ -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
