Technical data

Troubleshooting Techniques and Tools
1.2 Isolating Problems
1.2.5.2.3 Primitive Keywords Primitive keywords include:
• gateway
• broadcast
• less
• greater
• Arithmetic expressions
More complex filter expressions are formed by using the words and , or , and not
to combine primitives. For example:
host foo and not port ftp and not port ftp-data
To minimize keystrokes, identical keyword lists can be omitted. For example, the
following two lines are treated the same:
tcp dst port ftp or ftp-data or domain
tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain
1.2.5.2.4 Primitive Expressions The following list describes the results of using
some primitive expressions.
• dst host host
True if the IP destination field of the packet is host, which may be either an
address or a name.
• src host host
True if the IP source field of the packet is host.
• host host
True if either the IP source or destination of the packet is host. The following
keywords can precede any of these host expressions:
ip
arp
rarp
The following examples are equivalent:
ip host host
ether proto ip and host host
If host is a name with multiple IP addresses, each address is checked for a
match.
• ether dst ehost
True if the Ethernet destination address is ehost.
•
ether src ehost
True if the Ethernet source address is ehost.
•
ether host ehost
True if either the Ethernet source or destination address is ehost.
•
gateway host
True if the packet used host as a gateway. That is, the Ethernet source or
destination address was host but neither the IP source nor the IP destination
was host.
1–12 Troubleshooting Techniques and Tools