Chapter 2 - Features set
User Manual
R5000 series - Web GUI
55
2.4.5.6. Detailed filter expression syntax description
The filter expression determines which packets will be selected by the filter for further
processing. If no expression is given, all the packets on the net will be selected.
Otherwise, only the packets for which expression is
“true” will be selected.
There are three different kinds of qualifier:
Qualifier
Description
type
Qualifiers say to what the id name or number refers to
Possible types are: host, net, port, portrange
E.g.:
“host foo”, “net 128.3”, “port 20”, “portrange 6000-6008”
If there is no type qualifier, host is assumed
dir
Qualifiers specify a particular transfer direction to and/or from
id
Possible directions are: src, dst, src or dst and src and dst
E.g.:
“src 1.1.1.1”, “dst net 128.3”, “src or dst port 21”. If there
is no dir qualifier, src or dst is assumed
proto
Qualifiers restrict the match to a particular protocol
Possible protos are: ether, ip, ip6, arp, rarp, tcp and udp
E.g.:
“ether src 00:12:13:14:15:16”, “arp net 128.3”, “tcp port
21
”, “udp portrange 7000-7009”
If there is no proto qualifier, all protocols consistent with the
type are assumed
E.g.,
“src 1.1.1.1” means “(ip or arp or rarp) src foo” (except the
latter is not legal syntax),
“net 1.2.3.0/24” means “(ip or arp or
rarp) net 1.2.3.0/24
” and “port 53” means “(tcp or udp) port 53”
Table 10 - Qualifiers
In addition to the above, there are some special “primitive” keywords that don’t follow
the pattern: broadcast, less, greater and arithmetic expressions. All of these are
described below (see the Table 11).
More complex filter expressions are built up by using the words
“and”, “or” and “not”
to combine primitives. E.g.: “host foo and not port ftp and not port ftp-data”. To save
typing time
, identical qualifier lists can be omitted. E.g., “tcp dst port ftp or ftp-data
or domain” is exactly the same as “tcp dst port ftp or tcp dst port ftp-data or tcp dst
port domain”.
Allowable primitives are:
