308
Table 31 Arithmetic operators for capture filters
Nonalphanumeric
symbol
Description
+
Adds two values.
-
Subtracts one value from another.
*
Multiplies one value by another.
/
Divides one value by another.
&
Returns the result of the bitwise AND operation on two integral values in binary
form.
|
Returns the result of the bitwise OR operation on two integral values in binary form.
<<
Performs the bitwise left shift operation on the operand to the left of the operator.
The right-hand operand specifies the number of bits to shift.
>>
Performs the bitwise right shift operation on the operand to the left of the operator.
The right-hand operand specifies the number of bits to shift.
[ ]
Specifies a byte offset relative to a protocol layer. This offset indicates the byte
where the matching begins.
You must enclose the offset value in the brackets and specify a protocol qualifier.
For example,
ip[6]
matches the seventh byte of payload in IPv4 packets (the byte
that is six bytes away from the beginning of the IPv4 payload).
Table 32 Relational operators for capture filters
Nonalphanumeric
symbol
Description
=
Equal to.
For example,
ip[6]=0x1c
matches an IPv4 packet if its seventh byte of payload is
equal to 0x1c.
!=
Not equal to.
For example,
len!=60
matches a packet if its length is not equal to 60 bytes.
>
Greater than.
For example,
len>100
matches a packet if its length is greater than 100 bytes.
<
Less than.
For example,
len<100
matches a packet if its length is less than 100 bytes.
>=
Greater than or equal to.
For example,
len>=100
matches a packet if its length is greater than or equal to
100 bytes.
<=
Less than or equal to.
For example,
len<=100
matches a packet if its length is less than or equal to 100
bytes.
Display filter keywords
describe the qualifiers and variables for display filters, respectively.
