#bpf filter
filters=[(Constants.BPF_LD | Constants.BPF_H | Constants.BPF_ABS,0,0,12),
(Constants.BPF_JMP | Constants.BPF_JEQ | Constants.BPF_K,0,2,0x800),
(Constants.BPF_LD | Constants.BPF_W | Constants.BPF_ABS,0,0,26),
(Constants.BPF_RET | Constants.BPF_A,0,0,0),
(Constants.BPF_RET | Constants.BPF_K,0,0,0),
]
fprog=bpf_fprog(5,ctypes.pointer((bpf_inst*5)(*filters)))
is this filter correct? but,it returns full packet...I want to get return of packet[26:30] ...any solution?