SMC Networks ELITECONNECT SMC2502W User Manual page 153

Table A-1 Allowable Primitives (Continued)
Primitive
ip proto protocol
ip protochain protocol
ether broadcast
ip broadcast
ether multicast
ip multicast
ether proto protocol
vlan [vlan_id]
tcp, udp, icmp
expr relop expr
EliteConnect WLAN Security System User Manual
Explanation
True if the packet is an IP packet (see ip(4P)) of protocol type
protocol. Protocol can be a number or one of the names icmp,
icmp6, igmp, igrp, pim, ah, esp, udp, or tcp.
True if the packet contains protocol header with type protocol in
its protocol header chain. For example, ip protochain matches
any IPv4 packet with TCP protocol header in the protocol header
chain. The packet can contain, for example, authentication
header, routing header, or hop-by-hop option header, between
IPv4 header and TCP header.The BPF code emitted by this
primitive is complex and cannot be optimized by BPF optimizer
code in tcpdump, so this can be somewhat slow.
True if the packet is an Ethernet broadcast packet. The ether
keyword is optional.
True if the packet is an IP broadcast packet. It checks for both the
all-zeroes and all-ones broadcast conventions, and looks up the
local subnet mask.
True if the packet is an ethernet multicast packet. The ether
keyword is optional. This is shorthand for ether[0] & 1!= 0.
True if the packet is an IP multicast packet.
True if the packet is of ether type protocol. Protocol can be a
number or one of the names ip.
True if the packet is an IEEE 802.1Q VLAN packet. If [vlan_id] is
specified, then this is only true if the packet has the specified
vlan_id. Note that the first vlan keyword encountered in
expression changes the decoding offsets for the remainder of the
expression on the assumption that the packet is a VLAN packet.
Abbreviations for ip proto p, where p is one of the above
protocols.
True if the relation holds, where relop is one of >, <, >=, <=, =, !=,
and expr is an arithmetic expression composed of integer
constants (expressed in standard C syntax), the normal binary
operators [+, -, *, /, &, |], a length operator, and special packet
data accessors. To access data inside the packet, use the syntax
proto [expr : size]. The byte offset, relative to the indicated
protocol layer, is given by expr. Size is optional and indicates the
number of bytes in the field of interest; it can be either one, two,
or four, and defaults to one. The length operator, indicated by the
keyword len, gives the length of the packet.
A-3