267
Nonalphanumeri
c
symbol
Alphanumeric
symbol
Description
|| or
Joins two conditions.
Use this operator to display traffic that matches either of the
conditions.
Table 39 Relational operators for display filters
Nonalphanumeric
symbol
Alphanumeric
symbol
Description
== eq
Equal to.
For example,
ip.src==10.0.0.5
displays packets with the source
IP address as 10.0.0.5.
!= ne
Not equal to.
For example,
ip.src!=10.0.0.5
displays packets whose source
IP address is not 10.0.0.5.
> gt
Greater than.
For example,
frame.len>100
displays frames with a length
greater than 100 bytes.
< lt
Less than.
For example,
frame.len<100
displays frames with a length less
than 100 bytes.
>= ge
Greater than or equal to.
For example,
frame.len ge 0x100
displays frames with a length
greater than or equal to 256 bytes.
<= le
Less than or equal to.
For example,
frame.len le 0x100
displays frames with a length
less than or equal to 256 bytes.
Building a capture filter
This section provides the most commonly used expression types for capture filters.
Logical expression
Use this type of expression to capture packets that match the result of logical operations.
Logical expressions contain keywords and logical operators. For example:
• not port 23 and not port 22—Captures packets with a port number that is not 23 or 22.
• port 23 or icmp—Captures packets with a port number 23 or ICMP packets.
In a logical expression, a qualifier can modify more than one variable connected by its nearest logical
operator. For example, to capture packets sourced from IPv4 address 192.168.56.1 or IPv4 network
192.168.27, use either of the following expressions:
• src 192.168.56.1 or 192.168.27.
• src 192.168.56.1 or src 192.168.27.
The expr relop expr expression
Use this type of expression to capture packets that match the result of arithmetic operations.
To Next Page
Loading...
Need help?
General
