ethereal-tcpdump - TCPDUMP filters expression selects which...

Info iconThis preview shows pages 1–2. Sign up to view the full content.

View Full Document Right Arrow Icon
TCPDUMP filters expression selects which packets will be dumped. If no expression is given, all packets on the net will be dumped. Otherwise, only packets for which expres sion is `true' will be dumped. ber) preceded by one or more qualifiers. There are three different kinds of qualifier: type qualifiers say what kind of thing the id name or number refers to. Possible types are host , net and port . E.g., `host foo', `net 128.3', `port 20'. If there is no type qualifier, host is assumed. dir qualifiers specify a particular transfer direction to and/or from id . Possible directions are src , dst , src or dst and src and dst . E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'. If there is no dir qualifier, src or dst is assumed. For `null' link layers (i.e. point to point pro tocols such as slip) the inbound and out bound qualifiers can be used to specify a desired direction. proto qualifiers restrict the match to a particu lar protocol. Possible protos are: ether , fddi , tr , ip , ip6 , arp , rarp , decnet , tcp and udp . E.g., `ether src foo', `arp net 128.3', `tcp port 21'. If there is no proto qualifier, all protocols consistent with the type are assumed. E.g., `src foo' means `(ip or arp or rarp) src foo' (except the latter is not legal syntax), `net bar' means `(ip or arp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'. [`fddi' is actually an alias for `ether'; the parser treats them identically as meaning ``the data link level used on the specified network interface.'' FDDI headers contain Ethernet-like source and destination addresses, and often contain Ethernet-like packet types, so you can filter on these FDDI fields just as with the analogous Ether net fields. FDDI headers also contain other fields, but you cannot name them explicitly in a filter expression. Similarly, `tr' is an alias for `ether'; the previ ous paragraph's statements about FDDI headers also apply to Token Ring headers.] In addition to the above, there are some special `primitive' keywords that don't follow the pattern: gateway , broadcast , less , greater and arithmetic expressions. All of these are described below. tives. E.g., `host foo and not port ftp and not port ftp-data'. To save typing, identical quali fier lists can be omitted. E.g., `tcp dst port ftp or ftp-data or domain' is exactly the same as `tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'. Allowable primitives are: dst host host True if the IPv4/v6 destination field of the packet is host , which may be either an address or a name. src host host True if the IPv4/v6 source field of the packet is host . host host True if either the IPv4/v6 source or desti nation of the packet is host . Any of the above host expressions can be prepended with the keywords, ip , arp , rarp , or ip6 as in: ip host host which is equivalent to: ether proto \ip and host host If host is a name with multiple IP addresses, each address will be checked for a match. ether
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Image of page 2
This is the end of the preview. Sign up to access the rest of the document.

This note was uploaded on 05/13/2010 for the course REDES 7 taught by Professor Asesor during the Spring '10 term at UNE.

Page1 / 4

ethereal-tcpdump - TCPDUMP filters expression selects which...

This preview shows document pages 1 - 2. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online