学步园

没啥可说的, 直接代码.. 

#include <stdio.h><br /> #include <stdlib.h><br /> #include <string.h><br /> #include <unistd.h><br /> #include <stdint.h></p> <p>// TCP 标志<br /> #define TH_FIN 0x01<br /> #define TH_SYN 0x02<br /> #define TH_RST 0x04<br /> #define TH_PUSH 0x08<br /> #define TH_ACK 0x10<br /> #define TH_URG 0x20<br /> #define TH_ECE 0x40<br /> #define TH_CWR 0x80</p> <p>// TCP 合法标志组合, 标志PUSH, ECE, CWR为一直有效合法标志</p> <p>static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] = {<br /> [TH_SYN] = 1,<br /> [TH_SYN|TH_URG] = 1,<br /> [TH_SYN|TH_ACK] = 1,<br /> [TH_RST] = 1,<br /> [TH_RST|TH_ACK] = 1,<br /> [TH_FIN|TH_ACK] = 1,<br /> [TH_FIN|TH_ACK|TH_URG] = 1,<br /> [TH_ACK] = 1,<br /> [TH_ACK|TH_URG] = 1,<br /> };</p> <p>int main(int argc, char **argv)<br /> {<br /> uint8_t flags_max = 0xff;<br /> uint8_t i;<br /> uint8_t flags = 0;<br /> uint8_t mask = (uint8_t)~(TH_ECE | TH_CWR | TH_PUSH);<br /> for( i = 0; i < flags_max; i++ ){<br /> flags = i & mask;<br /> if ( tcp_valid_flags[flags] == 0 ) {<br /> // 标记已非法标志<br /> tcp_valid_flags[flags] = 0x2;<br /> printf("'tcp[13] & 0x%x = 0x%x' or ", mask, flags );<br /> }<br /> }<br /> printf("/n");<br /> return 0;<br /> }<br />

# gcc tcp_flags.c -o tcp_flags

# ./tcp_flags

输出

'tcp[13] & 0x37 = 0x0' or 'tcp[13] & 0x37 = 0x1' or 'tcp[13] & 0x37 = 0x3' or 'tcp[13] & 0x37 = 0x5' or 'tcp[13] & 0x37 = 0x6' or 'tcp[13] & 0x37 = 0x7'  or 'tcp[13] & 0x37 = 0x13' or 'tcp[13] & 0x37 = 0x15' or 'tcp[13] & 0x37 = 0x16' or 'tcp[13] & 0x37 = 0x17'  or 'tcp[13] & 0x37 = 0x15' or 'tcp[13] & 0x37 = 0x16' or 'tcp[13] & 0x37 = 0x17' or 'tcp[13] & 0x37 = 0x20' or 'tcp[13] & 0x37 = 0x21' or 'tcp[13] & 0x37 = 0x23' or 'tcp[13] & 0x37 = 0x24' or 'tcp[13] & 0x37 = 0x25' or 'tcp[13] & 0x37 = 0x26' or 'tcp[13] & 0x37 = 0x27' or 'tcp[13] & 0x37 = 0x20' or 'tcp[13] & 0x37 = 0x21' or 'tcp[13] & 0x37 = 0x23' or 'tcp[13] & 0x37 = 0x24' or 'tcp[13] & 0x37 = 0x25' or 'tcp[13] & 0x37 = 0x26' or 'tcp[13] & 0x37 = 0x27' or 'tcp[13] & 0x37 = 0x32' or 'tcp[13] & 0x37 = 0x33' or 'tcp[13] & 0x37 = 0x34' or 'tcp[13] & 0x37 = 0x35' or 'tcp[13] & 0x37 = 0x36' or 'tcp[13] & 0x37 = 0x37' or

去掉最后一个or 即是非法TCP标志组合