http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/blog/port-striping-v2
Again, since u32 works in 4-byte blocks, but we only require the first byte of a 4-byte block, we're going to subtract 3 from the offset, so 28-3=25. For the above iptables rule to also match that 0x38 byte, we'll add to it: iptables -m u32 --u32 "0=0x45000052 && 25&0xFF=0x38" According to the tutorial, instead of using the mask 0x000000FF we can just abbreviate to 0xFF, which makes the rule slightly shorter but still does what we want.