266
Variable
type
Description
•
ip.len le 1500
.
•
ip.len le 02734
.
•
ip.len le 0x436
.
Boolean
This variable type has two values: true or false.
This variable type applies if you use a packet field string alone to identify the presence of a
field in a packet.
•
If the field is present, the match result is true. The filter displays the packet.
•
If the field is not present, the match result is false. The filter does not display the packet.
For example, to display TCP packets that contain the SYN field, use
tcp.flags.syn
.
MAC
address (six
bytes)
Uses colons (:), dots (.), or hyphens (-) to break up the MAC address into two or four
segments.
For example, to display packets that contain a destination MAC address of ffff.ffff.ffff, use
one of the following expressions:
•
eth.dst==ff:ff:ff:ff:ff:ff
.
•
eth.dst==ff-ff-ff-ff-ff-ff
.
•
eth.dst ==ffff.ffff.ffff
.
IPv4 address
Represented in dotted decimal notation.
For example:
•
To display IPv4 packets that are sent to or from 192.168.0.1, use
ip.addr==192.168.0.1
.
•
To display IPv4 packets that are sent to or from 129.111.0.0/16, use
ip.addr==129.111.0.0/16
.
IPv6 address
Represented in colon hexadecimal notation.
For example:
•
To display IPv6 packets that are sent to or from 1::1, use
ipv6.addr==1::1
.
•
To display IPv6 packets that are sent to or from 1::/64, use
ipv6.addr==1::/64
.
String
Character string.
For example, to display HTTP packets that contain the string
HTTP/1.1
for the request
version field, use
http.request version=="HTTP/1.1"
.
Display filter operators
Display filters support logical operators (
) and relational operators (
). Both operator
types can use alphanumeric and nonalphanumeric symbols.
Logical operators are left associative. They group from left to right.
operators by priority, from the highest to the lowest. The
and
and
or
operators have the same priority.
Table 38 Logical operators for display filters
Nonalphanumeri
c
symbol
Alphanumeric
symbol
Description
[ ]
No alphanumeric
symbol is
available.
Used with protocol qualifiers. For more information, see "
."
! not
Displays packets that do not match the condition connected to
this operator.
&& and
Joins two conditions.
Use this operator to display traffic that matches both conditions.
