4*([14]&0xf)! ; l3_off(14) + 8 of udp + 12 of dns! ld #34! add x! tax! ; a = x = M[0] = offset of first dns query byte! ; st M[0]! ! lb_0:! ; ldx M[0]! ; Match: *! ldb [x + 0]! add x! add #1! tax! ; Match: 076578616d706c6503636f6d00 '\x07example\x03com\x00' mask=00000000000000000000000000! ld [x + 0]! jneq #0x07657861, lb_1! ld [x + 4]! jneq #0x6d706c65, lb_1! ld [x + 8]! jneq #0x03636f6d, lb_1! ldb [x + 12]! jneq #0x00, lb_1! ret #1! ! lb_1:! ret #0! $ ./bpfgen -o 14 dns -- *.example.com! 18,177 0 0 14,0 0 0 34,12 0 0 0,7 0 0 0,80 0 0 0,12 0 0 0,4 0 0 1,7 0 0 0,64 0 0 0,21 0 7 124090465,64 0 0 4,21 0 5 1836084325,64 0 0 8,21 0 3 56848237,80 0 0 12,21 0 1 0,6 0 0 1,6 0 0 0,!