Building A Capture Filter - HPE FlexNetwork 5510 HI Series Network Management And Monitoring Configuration Manual

Nonalphanumeri
c
symbol
&&
||
Table 35 Relational operators for display filters
Nonalphanumeric
symbol
==
!=
>
<
>=
<=

Building a capture filter

This section provides the most commonly used expression types for capture filters.
Logical expression
Use this type of expression to capture packets that match the result of logical operations.
Logical expressions contain keywords and logical operators. For example:
•
not port 23 and not port 22—Captures packets with a port number that is not 23 or 22.
•
port 23 or icmp—Captures packets with a port number 23 or ICMP packets.
In a logical expression, a qualifier can modify more than one variable connected by its nearest logical
operator. For example, to capture packets sourced from IPv4 address 192.168.56.1 or IPv4 network
192.168.27, use either of the following expressions:
•
src 192.168.56.1 or 192.168.27.
•
src 192.168.56.1 or src 192.168.27.
Alphanumeric
Description
symbol
Joins two conditions.
and
Use this operator to display traffic that matches both conditions.
Joins two conditions.
or
Use this operator to display traffic that matches either of the
conditions.
Alphanumeric
Description
symbol
Equal to.
eq
For example, ip.src==10.0.0.5 displays packets with the
source IP address as 10.0.0.5.
Not equal to.
ne
For example, ip.src!=10.0.0.5 displays packets whose source
IP address is not 10.0.0.5.
Greater than.
gt
For example, frame.len>100 displays frames with a length
greater than 100 bytes.
Less than.
lt
For example, frame.len<100 displays frames with a length less
than 100 bytes.
Greater than or equal to.
ge
For example, frame.len ge 0x100 displays frames with a
length greater than or equal to 256 bytes.
Less than or equal to.
le
For example, frame.len le 0x100 displays frames with a length
less than or equal to 256 bytes.
238