Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In its description of valid tcpdump expressions, the pcap-filter man pages state:

The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by one or more qualifiers.

In turn, these qualifiers are type, dir and proto. So far so good, but further down we find this:

     ip host host
which is equivalent to:
     ether proto \ip and host host

In the first case, ip and host are, respectively, proto and type. What pattern does ether proto \ip follow? Isn't that, as a whole, a proto qualifier? If so, why isn't (a properly escaped) 'ether proto \ip host host' legal (no and)?

share|improve this question
up vote 1 down vote accepted

In ether proto \ip "\ip" is the ID. That ether proto \ip means the same like ip on the content level does not mean that both has to be syntactically equivalent.

share|improve this answer
Thanks for posting an answer! I should have come back here and referred to the question I later posted on the tcpdump-workers list. Here is the corresponding answer. – ezequiel-garzon Apr 22 '13 at 19:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.