In its description of valid tcpdump expressions, the pcap-filter man pages state:
The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by one or more qualifiers.
In turn, these qualifiers are
proto. So far so good, but further down we find this:
ip host host which is equivalent to: ether proto \ip and host host
In the first case,
host are, respectively,
type. What pattern does
ether proto \ip follow? Isn't that, as a whole, a
proto qualifier? If so, why isn't (a properly escaped) '
ether proto \ip host host' legal (no