237
Variable
Description
• ip.len le 1500.
• ip.len le 02734.
•
.
Boolean
This variable type has two values: true or false.
This variable type applies if you use a packet field string alone to identify the presence of a
field in a packet.
• If the field is present, the match result is true. The filter displays the packet.
• If the field is not present, the match result is false. The filter does not display the packet.
For example, to display TCP packets that contain the SYN field, use
.
MAC
address
(six bytes)
Uses colons (:), dots (.), or hyphens (-) to break up the MAC address into two or four
segments.
For example, to display packets that contain a destination MAC address of ffff.ffff.ffff, use one
of the following expressions:
• eth.dst==ff:ff:ff:ff:ff:ff.
• eth.dst==ff-ff-ff-ff-ff-ff.
• eth.dst ==ffff.ffff.ffff.
IPv4
address
Represented in dotted decimal notation.
For example:
• To display IPv4 packets that are sent to or from 192.168.0.1, use ip.addr==192.168.0.1.
• To display IPv4 packets that are sent to or from
129.111.0.0/16, use
ip.addr==129.111.0.0/16
.
IPv6
address
Represented in colon hexadecimal notation.
For example:
• To display IPv6 packets that are sent to or from 1::1, use ipv6.addr==1::1.
• To display IPv6 packets that are sent to or from 1::/64, use ipv6.addr==1::/64.
String
Character string.
For example, to display HTTP packets that contain the string
HTTP/1.1
for the request version
field, use
http.request version=="HTTP/1.1"
.
Display filter operators
Display filters support logical operators (Table 34) and relational operators (Table 35). Both operator
types can use alphanumeric and nonalphanumeric symbols.
Logical operators are left associative. They group from left to right. Table 34 displays logical
operators by priority, from the highest to the lowest. The and and or operators have the same
priority:
Table 34 Logical operators for display filters
Nonalphanumeri
c
Alphanumeric
symbol
Description
[ ]
No alphanumeric
available.
Used with protocol qualifiers. For more information, see "The
proto[…] expression."
! not
Displays packets that do not match the condition connected to
this operator.