User's Manual Part 2

December 20, 2004 SCP-LPS20x-011-012-01H

ADC Telecommunications, Inc. 171

In addition to Table 16, there are some special “primitive” keywords that do not follow the pattern: gateway,

broadcast, less, greater and arithmetic expressions. For more detailed information, consult one of the many

TCPDUMP pages available on the Internet. More complex filter expressions are built up by using the words: “and”,

“or”, and “not” to combine primitives.

For Example:

host 192.168.30.57 and not port ftp and not port ftp-data

To save typing, identical qualifier lists can be omitted.

For Example:

tcp dst port ftp or ftp-data or domain

is exactly the same as

tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain

The following examples show how to construct some basic trace filters.

src 192.168.30.57

src not 192.168.130.57

src or dst 192.168.30.57

src or dst net 192.168.130

tcp port 21 or tcp port 20 which is the same as tcp port 21 or 20

dst port 21 and tcp

tcp port 21 and src or dst 192.168.130.57

icmp

broadcast