[LARTC] match'ing packets by size

[Ethy H. Brito]

I visited yesican.chsoft.biz and the author proposes a way to match packets by
less than some size .

Here is the thing:

match u16 0x0000 0xffb0 at 2

With this match he says that packet with less than 80 bytes will match the rule.

Well, 0xffb0 translates to 1111 1111 1011 0000 (which is -80 BTW).

So, if I am correct any packet with bits 4 and/or 5 set (together with any of
the 4 LSB's) will break the rule. They will still be less than 80 bytes.

If it is so, packets of lenght, for instance,  16, 32 or 48 (32+16) will not make it.

I think the proposed solution only works with (2^n)-1 sized packets.
Am I correct or I completely misunderstood it?

Regards

-- 

Ethy H. Brito         /"\
InterNexo Ltda.       \ /  CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
+55 (12) 3941-6860     X   ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
S.J.Campos - Brasil   / \