> checks whether the packet has a "more fragments" field, *regardless of > whether it's zero or one*. I.e., it, in effects, checks whether the IP > flags are present at all, not whether it has the 0x04 or the 0x02 bit > set.
I see. That works for me too, so no problem after all. But does that mean that it always matches? (ie: ip.flags.mf ) That flag is always present wether or not the flag is set. Vince.
