http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/blog/port-striping-v2
From http://www.stearns.org/doc/iptables-u32.current.html : In it's simplest form, u32 grabs a block of 4 bytes starting at Start, applies a mask of Mask to it, and compares the result to Range. Here's the syntax we'll use for our first examples: iptables -m u32 --u32 "Start&Mask=Range" Since u32 grabs blocks of 4 bytes at a time, to match the first 4 bytes of our tcpdump output, we don't need a mask.