title: Understanding Tcpdump filter & bit-masking
body: <p>I am trying to sniff the http headers by using tcpdump.</p>
  
  <p>This filter works well but I can't understand it -</p>
  
  <pre><code>(((ip[2:2] - ((ip[0]&amp;0xf)&lt;&lt;2)) - ((tcp[12]&amp;0xf0)&gt;&gt;2)) != 0)
  </code></pre>
  
  <p>I've googled it but I can't find any useful info</p>
  
  <p>Here is the whole tcpdump command </p>
  
  <pre><code>sudo tcpdump -A 'dst [dest host] or src [src host]  and tcp  and 
  (((ip[2:2] - ((ip[0]&amp;0xf)&lt;&lt;2)) - ((tcp[12]&amp;0xf0)&gt;&gt;2)) != 0)' -i eth0
  </code></pre>