So i tried searching for results on google and this is what i found-
tcpdump -n -s0 -p -i eth0 'ip and tcp and (((ip[2:2] - ((ip&0xf)<<2)) - ((tcp&0xf0)>>2)) >= 4) and (((ip[2:2] - ((ip&0xf)<<2)) - ((tcp&0xf0)>>2)) <= 6)'
The above is used to find payload size between 4 and 6 bytes for any ip on eth0, i did try out the command and it looks like the checkpoint cli is accepting the command, my question is what if i want to enter a specific ip? Where do i type that in the above command and how would it look?
Thanks and regards in advance.