On Wed, 28 Sep 2016 16:43:38 +0200 Daniel Borkmann [off-list ref] wrote:

quoted

(1) suppose upon entry we have

     DA,SA,0x8100,TCI,0x0800,
     ^                ^
     mac_hdr          data

initial offset is 18, and after current unwinding code we'll get  

You mean data points after the 0x0800, right?

Sorry. Yes, exactly as you say. Initially 18 bytes ahead:

    DA,SA,0x8100,TCI,0x0800,
    ^                       ^
    mac_hdr                 data