AudioCodes Mediant 3000 User Manual page 620

Supported Wireshark-like Expressions for 'Value' Parameter
Expression
ip.src, ip.dst
ip.addr
ip.proto
udp, tcp, icmp, sip, ldap, http, https
udp.port, tcp.port
udp.srcport, tcp.srcport
udp.dstport, tcp.dstport
and, &&, ==, <, >
Below are examples of configured expressions for the 'Value' parameter:

udp && ip.addr==10.8.6.55

ip.src==10.8.6.55 && udp.port>=5000 and udp.port<6000

ip.dst==10.8.0.1/16

ip.addr==10.8.6.40
For conditions requiring the "or" / "||" expression, add multiple table rows. For example, the
Wireshark condition "(ip.src == 1.1.1.1 or ip.src == 2.2.2.2) and ip.dst == 3.3.3.3" can be
configured using the following two table row entries:
1. ip.src == 1.1.1.1 and ip.dst == 3.3.3.3
2. ip.src == 2.2.2.2 and ip.dst == 3.3.3.3
The linked image cannot be displayed. The file may have been moved, renamed, or deleted. Verify that the link points to the correct file and location.
Note:
User's Manual
Source and destination IP address
IP address - up to two IP addresses can be entered
IP protocol type (PDU) entered as an enumeration value
(e.g., 1 is ICMP, 6 is TCP, 17 is UDP)
Single expressions for protocol type
Transport layer
Transport layer for source port
Transport layer for destination port
Between expressions
If the 'Value' field is left empty, the device will record all IP traffic types.
Description
620
Mediant 3000
Document #: LTRT-89729