264
Capture filter operators
Capture filters support logical operators (
), and relational
operators (
). Logical operators can use both alphanumeric and nonalphanumeric symbols.
The arithmetic and relational operators can use only nonalphanumeric symbols.
Logical operators are left associative. They group from left to right. The
not
operator has the highest
priority. The
and
and
or
operators have the same priority.
Table 33 Logical operators for capture filters
Nonalphanumer
ic symbol
Alphanumeric
symbol
Description
! not
Reverses the result of a condition.
Use this operator to capture traffic that matches the opposite
value of a condition.
For example, to capture non-HTTP traffic, use
not port 80
.
&& and
Joins two conditions.
Use this operator to capture traffic that matches both conditions.
For example, to capture non-HTTP traffic that is sent to or from
1.1.1.1, use
host 1.1.1.1 and not port 80
.
|| or
Joins two conditions.
Use this operator to capture traffic that matches either of the
conditions.
For example, to capture traffic that is sent to or from 1.1.1.1 or
2.2.2.2, use
host 1.1.1.1 or host 2.2.2.2
.
Table 34 Arithmetic operators for capture filters
Nonalphanumeric
symbol
Description
+
Adds two values.
-
Subtracts one value from another.
*
Multiplies one value by another.
/
Divides one value by another.
&
Returns the result of the bitwise AND operation on two integral values in binary
form.
|
Returns the result of the bitwise OR operation on two integral values in binary form.
<<
Performs the bitwise left shift operation on the operand to the left of the operator.
The right-hand operand specifies the number of bits to shift.
>>
Performs the bitwise right shift operation on the operand to the left of the operator.
The right-hand operand specifies the number of bits to shift.
[ ]
Specifies a byte offset relative to a protocol layer. This offset indicates the byte
where the matching begins.
You must enclose the offset value in the brackets and specify a protocol qualifier.
For example,
ip[6]
matches the seventh byte of payload in IPv4 packets (the byte
that is six bytes away from the beginning of the IPv4 payload).
