Packet Captures: Difference between revisions
m
→Capture Filter Primitives: m
m (→Modifiers: m) |
m (→Capture Filter Primitives: m) |
||
Line 361:
! Filter !! Description
|-
| <nowiki>[src|dst]</nowiki> host <host> || Matches a host as the IP source, destination, or either
|-
| <nowiki>ether [src|dst] host <ehost></nowiki> || Matches a host as the Ethernet source, destination, or either
|-
| gateway host <host> || Matches packets which used host as a gateway
|-
| <nowiki>[src|dst] net <network>/<len></nowiki> || Matches packets to or from an endpoint residing in network
|-
| <nowiki>[tcp|udp] [src|dst] port <port></nowiki> || Matches TCP or UDP packets sent to/from port
|-
| <nowiki>[tcp|udp] [src|dst] portrange <p1>-<p2></nowiki> || Matches TCP or UDP packets to/from a port in the given range
|-
| less <length> || Matches packets less than or equal to length
Line 377:
| greater <length> || Matches packets greater than or equal to length
|-
| <nowiki>(ether|ip|ip6) proto <protocol></nowiki> || Matches an Ethernet, IPv4, or IPv6 protocol
|-
| <nowiki>(ether|ip) broadcast</nowiki> || Matches Ethernet or IPv4 broadcasts
|-
| <nowiki>(ether|ip|ip6) multicast</nowiki> || Matches Ethernet, IPv4, or IPv6 multicasts
|-
| <nowiki>type (mgt|ctl|data) [subtype <subtype>]</nowiki> || Matches 802.11 frames based on type and optional subtype
|-
| <nowiki>vlan [<vlan>]</nowiki> || Matches 802.1Q frames, optionally with a VLAN ID of vlan
|-
| <nowiki>mpls [<label>]</nowiki> || Matches MPLS packets, optionally with a label of label
|-
| <nowiki><expr> <relop> <expr></nowiki> || Matches packets by an arbitrary expression
|}
| |||