wciq1208 opened this issue 3 years ago · 2 comments
图里114的正确结果也满足ip.id = 0并且1Q1A
确实有可能,这个规律总之很迷==所以搞规则的时候感觉还是要谨慎一些,只对特定dns生效比较保险。
udp src port 53 and ip[4:2] = 0x0000 and ip[6:2] = 0x0000 and ip[8] <= 40 and udp[12:2] = 0x0001 and udp[14:2] = 0x0001 and udp[16:2] = 0x0000