Coyote Point Systems Equalizer GX Series, Administration Manual

Page: 775 / 866

Examples
Expressions select which packets will be included in the packet capture. If no expression is given,
ALL packets on the network with are from/to the specified VLAN/interface(port)/aggregated
interface/cluster/server will be included. Otherwise, only packets for which the expression is
"true" will be captured.
Header based filtering;
1. Capture only the SYN packets on an interface
if01
:
eqcli-diags> tcpdump capture iface if01 expr “tcp[13] &2!=0”
2. Capture only SYN or FIN packets on a vlan
vl01
:
eqcli-diags>
tcpdump capture vlan vl01 expr “tcp[13] &3!=0”
3. Capture all packets to/from a cluster
cl01
that are larger than 576 bytes:
eqcli-diags> tcpdump capture cluster cl01 expr “ip[2:2] > 576 ”
Host based filtering;
1. Capture traffic between a server
sv01
and a host with IP
#.#.#.#
:
eqcli-diags> tcpdump capture server sv01 expr “host #.#.#.#”
Filtering Ports;
1. Capture all packets to/from a cluster
cl01
and a port
XX
:
eqcli-diags>
tcpdump capture cluster cl01 expr “port XX”
Protocol Filtering;
1. Capture all
icmp
packets to/from an interface instance
if01
:
eqcli-diags>
tcpdump capture iface if01 expr “icmp”
Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.
All Rights Reserved. 775
Equalizer Administration Guide