Technical data

Troubleshooting Techniques and Tools
1.2 Isolating Problems
This expression is equivalent to the following:
ether host ehost and not host host
You can use either names or numbers for host and ehost.
• dst net net
(IPv4 networks only) True if the IP destination address of the packet has a
network number of net, which may be either an address or a name.
• src net net
(IPv4 networks only) True if the IP source address of the packet has a
network number of net.
• net net
(IPv4 networks only) True if either the IP source or destination address of the
packet has a network number of net.
• dst port port
True if the packet is IP/TCP or IP/UDP and has a destination port value of
port.
• src port port
True if the packet has a source port value of port.
• port port
True if either the source or destination port of the packet is port. The
following keywords can precede any of these port expressions:
tcp
udp
For example, the following example matches only TCP packets:
tcp src port port
• less length
True if the packet has a length less than or equal to length. The following
example is equivalent:
len <= length
• greater length
True if the packet has a length greater than or equal to length. The following
example is equivalent:
len >= length
• ip proto protocol
True if the packet is an IP packet of protocol type protocol. The protocol can
be a number, or one of the following names:
ipv6
icmp
icmpv6
udp
nd
Troubleshooting Techniques and Tools 1–13