Newtec MDM9000 - Layer 3 Examples

Newtec Proprietary
Confidentiality: Unrestricted
R3.2_v1.0
339/387
Appendix - Classification Expressions
MDM9000 Satellite Modem
19.2 Layer 3 Examples
19.2.1 Frequently used Layer 3 Expressions
The following table provides an overview on frequently used Layer 3 expressions.
The first three expressions are explained in more detail to provide more info on the mechanism.
Expression Description
ip4 dst net 0.0.0.0/0 Default capture expression for all IPv4 packets.
(Refer to Expression:ip4dstnet0.0.0.0/0onpage340)
ip4 dst net 10.10.10.0/24 and protocol
icmp
Used to filter out icmp messages and enabling to
prioritize those messages (used frequently as SLA
reference).
(Refer to Expression:ip4dst10.10.10.0/24onpage342)
ip4 dst net 10.4.1.0/24 Capture a certain (sub)net.
(Refer to
Expression:ip4dstnet10.10.10.0/24andProtocolicmponp
age344)
ip4 dst host 10.4.1.10 Capture a certain destination host.
ip4 protocol icmp Capture on icmp protocol.
ip4 protocol <protocol number> capture on the protocol defined by the protocol
number.
ip4 dscp <dscp value> capture on a certain dscp value set in the IP header.
ip4 src host 1.2.3.4 capture on a specific source IP address.
ip dst net 10.6.4.0/24 or ip dst host
192.168.1.99 or ip dst net
192.168.1.0/24
Nested expression capturing packets with destination
IP address set within one of the mentioned subnets.