HPE FlexNetwork 10500 SERIES, Configuration Manual

Page: 322 / 407

311
Nonalphanumeric
symbol
Alphanumeric
symbol
Description
>= ge
Greater than or equal to.
For example, frame.len ge 0x100 displays frames with a length
greater than or equal to 256 bytes.
<= le
Less than or equal to.
For example, frame.len le 0x100 displays frames with a length
less than or equal to 256 bytes.
Building a capture filter
This section provides the most commonly used expression types for capture filters.
Logical expression
Use this type of expression to capture packets that match the result of logical operations.
Logical expressions contain keywords and logical operators. For example:
•
not port 23 and not port 22 —Captures packets with a port number that is not 23 or 22.
•
port 23 or icmp —Captures packets with a port number 23 or ICMP packets.
In a logical expression, a qualifier can modify more than one variable connected by its nearest logical
operator. For example, to capture packets sourced from IPv4 address 192.168.56.1 or IPv4 network
192.168.27, use either of the following expressions:
•
src 192.168.56.1 or 192.168.27 .
•
src 192.168.56.1 or src 192.168.27 .
The expr relop expr expression
Use this type of expression to capture packets that match the result of arithmetic operations.
This expression contains keywords, arithmetic operators ( expr ), and relational operators ( relop ). For
example, len+100>=200 captures packets that are greater than or equal to 100 bytes.
The proto [ expr:size ] expression
Use this type of expression to capture packets that match the result of arithmetic operations on a
number of bytes relative to a protocol layer.
This type of expression contains the following elements:
•
proto— Specifies a protocol layer.
•
[]—Performs arithmetic operations on a number of bytes relative to the protocol layer.
•
expr —Specifies the arithmetic expression.
•
size —Specifies the byte offset. This offset indicates the number of bytes relative to the protocol
layer. The operation is performed on the specified bytes. The offset is set to 1 byte if you do not
specify an offset.
For example, ip[0]&0xf !=5 captures an IP packet if the result of ANDing the first byte with 0x0f is not
5.
To match a field, you can specify a field name for expr : size . For example, icmp[icmptype]=0x08
captures ICMP packets that contain a value of 0x08 in the Type field.
The vlan vlan_id expression
Use this type of expression to capture 802.1Q tagged VLAN traffic.