309
Table 33 Qualifiers for display filters
Category
Description
Examples
Protocol
Matches a protocol.
•
eth
—Matches Ethernet.
•
ftp
—Matches FTP.
•
http
—Matches HTTP.
•
icmp
—Matches ICMP.
•
ip
—Matches IPv4.
•
ipv6
—Matches IPv6.
•
tcp
—Matches TCP.
•
telnet
—Matches Telnet.
•
udp
—Matches UDP.
Packet field
Matches a field in packets by using a
dotted string in the
protocol.field[.level1-subfield]…[.leveln-
subfield]
format.
•
tcp.flags.syn
—Matches the SYN bit in
the flags field of TCP.
•
tcp.port
—Matches the source or
destination port field.
NOTE:
The protocol qualifiers cannot modify variables.
Table 34 Variable types for display filters
Variable
type
Description
Integer
Represented in binary, octal, decimal, or hexadecimal notation.
For example, to display IP packets that are less than or equal to 1500 bytes, use one of the
following expressions:
•
ip.len le 1500
.
•
ip.len le 02734
.
•
ip.len le 0x436
.
Boolean
This variable type has two values: true or false.
This variable type applies if you use a packet field string alone to identify the presence of a
field in a packet.
•
If the field is present, the match result is true. The filter displays the packet.
•
If the field is not present, the match result is false. The filter does not display the packet.
For example, to display TCP packets that contain the SYN field, use
tcp.flags.syn
.
MAC
address (six
bytes)
Uses colons (:), dots (.), or hyphens (-) to break up the MAC address into two or four
segments.
For example, to display packets that contain a destination MAC address of ffff.ffff.ffff, use one
of the following expressions:
•
eth.dst==ff:ff:ff:ff:ff:ff
.
•
eth.dst==ff-ff-ff-ff-ff-ff
.
•
eth.dst ==ffff.ffff.ffff
.
IPv4
address
Represented in dotted decimal notation.
For example:
•
To display IPv4 packets that are sent to or from 192.168.0.1, use
ip.addr==192.168.0.1
.
•
To display IPv4 packets that are sent to or from 129.111.0.0/16, use
ip.addr==129.111.0.0/16
.
