SMC Networks ELITECONNECT SMC2502W User Manual page 151

S
YNTAX OF
This appendix describes client rights as referred to by the tcpdump utility.
Expression selects which packets will be dumped. If no expression is given all
packets on the net will be dumped. Otherwise, only packets for which expression is
'true' will be dumped.
The expression consists of one or more primitives. Primitives usually consist of an
id (name or number) preceded by one or more qualifiers. There are three different
kinds of qualifier:
• Type qualifiers say what kind of thing the id name or number refers to. Possible
types are host, net and port. Examples are 'host foo', 'net 128.3', and 'port 20'. If
there is no type qualifier, host is assumed.
• Dir qualifiers specify a particular transfer direction to and/or from id. Possible
directions are src, dst, src or dst, and src and dst. Examples are 'src foo', 'dst net
128.3', 'src or dst port ftp-data'. If there is no dir qualifier, src or dst is assumed.
For null link layers (i.e. point to point protocols such as slip) the inbound and
outbound qualifiers can be used to specify a desired direction.
• Proto qualifiers restrict the match to a particular protocol. Possible protos are:
ether, ip, tcp and udp. Examples are 'ether src foo', 'arp net 128.3', and 'tcp port
21'. If there is no proto qualifier, all protocols consistent with the type are
assumed.
In addition to the above, there are some special 'primitive' keywords that don't
follow the pattern: gateway, broadcast, less, greater and arithmetic expressions.
All of these are described below.
More complex filter expressions are built up by using the words and, or and not
to combine primitives. Examples are 'host foo', 'not port ftp', and 'not port ftp-
data'. To save typing, identical qualifier lists can be omitted. For example 'tcp dst
port ftp' or 'ftp-data or domain' are exactly the same as 'tcp dst port ftp, tcp dst
port ftp-data, or tcp dst port domain'.
EliteConnect WLAN Security System User Manual
C R
LIENT IGHTS
A
A-1