[Winpcap-users] What do the expressions guarantee to me?

[Guy Harris]

Ramiro Polla wrote:

> By compiling the expression "ip and (tcp or udp)", what I am guaranteed 
> to have?
> Such as in checksum calculation of ip header, tcp/udp header, and 
> tcp/udp data.
> 
> Does it do any checksum at all,

No.

> or just tells me that the ethernet data 
> (or whatever), has IP set as the protocol, and inside the ip header (or 
> the bytes that would correspond to an ip header) TCP or UDP are set as 
> the protocol?

Yes.