268
This expression contains keywords, arithmetic operators (
expr
), and relational operators (
relop
). For
example,
len+100>=200
captures packets that are greater than or equal to 100 bytes.
The proto [ expr:size ] expression
Use this type of expression to capture packets that match the result of arithmetic operations on a
number of bytes relative to a protocol layer.
This type of expression contains the following elements:
•
proto—
Specifies a protocol layer.
•
[]—Performs arithmetic operations on a number of bytes relative to the protocol layer.
•
expr
—Specifies the arithmetic expression.
•
size
—Specifies the byte offset. This offset indicates the number of bytes relative to the protocol
layer. The operation is performed on the specified bytes. The offset is set to 1 byte if you do not
specify an offset.
For example,
ip[0]&0xf !=5
captures an IP packet if the result of ANDing the first byte with 0x0f is not
5.
To match a field, you can specify a field name for
expr
:
size
. For example,
icmp[icmptype]=0x08
captures ICMP packets that contain a value of 0x08 in the Type field.
The vlan vlan_id expression
Use this type of expression to capture 802.1Q tagged VLAN traffic.
This type of expression contains the
vlan
vlan_id
keywords and logical operators. The
vlan_id
variable is an integer that specifies a VLAN ID. For example,
vlan 1 and ip6
captures IPv6 packets
in VLAN 1.
To capture 802.1Q tagged traffic, you must use the
vlan
vlan_id
expression prior to any other
expressions. An expression matches untagged packets if it does not follow a
vlan
vlan_id
expression. For example:
•
vlan 1 and !tcp—Captures VLAN 1-tagged non-TCP packets.
•
icmp and vlan 1
—Captures untagged ICMP packets that are VLAN 1 tagged. This expression
does not capture any packets because no packets can be both tagged and untagged.
Building a display filter
This section provides the most commonly used expression types for display filters.
Logical expression
Use this type of expression to display packets that match the result of logical operations.
Logical expressions contain keywords and logical operators. For example,
ftp or icmp
displays all
FTP packets and ICMP packets.
Relational expression
Use this type of expression to display packets that match the result of comparison operations.
Relational expressions contain keywords and relational operators. For example,
ip.len<=28
displays
IP packets that contain a value of 28 or fewer bytes in the length field.
Packet field expression
Use this type of expression to display packets that contain a specific field.
Packet field expressions contain only packet field strings. For example,
tcp.flags.syn
displays all
TCP packets that contain the SYN bit field.
The proto[…] expression
Use this type of expression to display packets that contain specific field values.
