312
This type of expression contains the
vlan
vlan_id
keywords and logical operators. The
vlan_id
variable is an integer that specifies a VLAN ID. For example,
vlan 1 and ip6
captures IPv6 packets
in VLAN 1.
To capture 802.1Q tagged traffic, you must use the
vlan
vlan_id
expression prior to any other
expressions. An expression matches untagged packets if it does not follow a
vlan
vlan_id
expression. For example:
•
vlan 1 and !tcp
—Captures VLAN 1-tagged non-TCP packets.
•
icmp and vlan 1
—Captures untagged ICMP packets that are VLAN 1 tagged. This expression
does not capture any packets because no packets can be both tagged and untagged.
Building a display filter
This section provides the most commonly used expression types for display filters.
Logical expression
Use this type of expression to display packets that match the result of logical operations.
Logical expressions contain keywords and logical operators. For example,
ftp or icmp
displays all
FTP packets and ICMP packets.
Relational expression
Use this type of expression to display packets that match the result of comparison operations.
Relational expressions contain keywords and relational operators. For example,
ip.len<=28
displays
IP packets that contain a value of 28 or fewer bytes in the length field.
Packet field expression
Use this type of expression to display packets that contain a specific field.
Packet field expressions contain only packet field strings. For example,
tcp.flags.syn
displays all
TCP packets that contain the SYN bit field.
The proto[…] expression
Use this type of expression to display packets that contain specific field values.
This type of expression contains the following elements:
•
proto—
Specifies a protocol layer or packet field.
•
[
…
]—Matches a number of bytes relative to a protocol layer or packet field. Values for the bytes
to be matched must be a hexadecimal integer string. The expression in brackets can use the
following formats:
[
n
:
m
]—Matches a total of
m
bytes after an offset of
n
bytes from the beginning of the
specified protocol layer or field. To match only 1 byte, you can use both [n] and [n:1] formats.
For example,
eth.src[0:3]==00:00:83
matches an Ethernet frame if the first three bytes of
its source MAC address are 0x00, 0x00, and 0x83. The
eth.src[2] == 83
expression
matches an Ethernet frame if the third byte of its source MAC address is 0x83.
[
n
-
m
]—Matches a total of (
m-n+1
) bytes, starting from the (
n+1)
th byte relative to the
beginning of the specified protocol layer or packet field. For example,
eth.src[1-2]==00:83
matches an Ethernet frame if the second and third bytes of its source MAC address are
0x00 and 0x83, respectively.
Configuration restrictions and guidelines
Before configuring this feature, make sure no other users are using this feature on the device.
When you configure the packet capture, follow these restrictions and guidelines:
