263
Category Description Examples
Direction
Matches packets based on its
source or destination location (an
IP address or port number).
If you do not specify a direction
qualifier, the
src or dst
qualifier
applies.
• src—Matches the source IP address
field.
• dst—Matches the destination IP address
field.
• src or dst—Matches the source or
destination IP address field.
NOTE:
The src or dst qualifier applies if you do not
specify a direction qualifier. For example,
port 23 is equivalent to src or dst port 23.
Type Specifies the direction type.
• host—Matches the IP address of a host.
• net—Matches an IP subnet.
• port—Matches a service port number.
• portrange—Matches a service port
range.
NOTE:
The host qualifier applies if you do not
specify any type qualifier. For example, src
2.2.2.2 is equivalent to src host 2.2.2.2.
To specify an IPv6 subnet, you must specify
the net qualifier.
Others
Any other qualifiers than the
previously described qualifiers.
• broadcast—Matches broadcast packets.
• multicast—Matches multicast and
broadcast packets.
• less—Matches packets that are less than
or equal to a specific size.
• greater—Matches packets that are
greater than or equal to a specific size.
• len—Matches the packet length.
• vlan—Matches VLAN packets.
NOTE:
The broadcast, multicast, and all protocol qualifiers cannot modify variables.
Table 32 Variable types for capture filters
Variable type Description Examples
Integer
Represented in binary, octal,
decimal, or hexadecimal notation.
The
port 23
expression matches traffic sent to or
from port number 23.
Integer range
Represented by hyphenated
integers.
The
portrange 100-200
expression matches traffic
sent to or from any ports in the range of 100 to 200.
IPv4 address
Represented in dotted decimal
notation.
The
src 1.1.1.1
expression matches traffic sent
from the IPv4 host at 1.1.1.1.
IPv6 address
Represented in colon hexadecimal
notation.
The
dst host 1::1
expression matches traffic sent
to the IPv6 host at 1::1.
IPv4 subnet
Represented by an IPv4 network ID
or an IPv4 address with a mask.
Both of the following expressions match traffic sent
to or from the IPv4 subnet 1.1.1.0/24:
• src 1.1.1.
• src net 1.1.1.0/24.
IPv6 network
segment
Represented by an IPv6 address
with a prefix length.
The
dst net 1::/64
expression matches traffic sent
to the IPv6 network 1::/64.
To Next Page
Loading...
Need help?
General
