[Winpcap-users] Filtering with BPF

[Guy Harris]

Leonardo Barata wrote:

> As far as I know no, they don't vary. They're always of the same size 
> (ethernet + ip + tcp headers)

No.  The Ethernet header is a fixed 14 bytes, but the IP and TCP headers 
can have options, so their length is variable.

For IPv4, see http://www.tcpdump.org/lists/workers/2005/11/msg00027.html 
for an example of a capture filter to check for TCP packets without any 
payload.