The attached patch adds left- and right-shift (<< and >>) to the list of binary operators on the tcpdump man page. E.g. "tcp[12] >> 4 > 5" will test for TCP options. The operators are listed in the '93 Usenix paper, and appear to have been supported in libpcap since the 0.0 release.
Index: tcpdump.1 =================================================================== RCS file: /tcpdump/master/tcpdump/tcpdump.1,v retrieving revision 1.152 diff -u -r1.152 tcpdump.1 --- tcpdump.1 19 Nov 2003 01:59:19 -0000 1.152 +++ tcpdump.1 21 Nov 2003 03:57:21 -0000 @@ -1013,10 +1013,11 @@ on a meta signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect, Release, or Release Done message. .IP "\fIexpr relop expr\fR" -True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =, !=, -and \fIexpr\fR is an arithmetic expression composed of integer constants -(expressed in standard C syntax), the normal binary operators -[+, -, *, /, &, |], a length operator, and special packet data accessors. +True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =, +!=, and \fIexpr\fR is an arithmetic expression composed of integer +constants (expressed in standard C syntax), the normal binary operators +[+, -, *, /, &, |, <<, >>], a length operator, and special packet data +accessors. To access data inside the packet, use the following syntax: .in +.5i
