Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In its description of valid tcpdump expressions, the pcap-filter man pages state:

The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by one or more qualifiers.

In turn, these qualifiers are type, dir and proto. So far so good, but further down we find this:

     ip host host
which is equivalent to:
     ether proto \ip and host host

In the first case, ip and host are, respectively, proto and type. What pattern does ether proto \ip follow? Isn't that, as a whole, a proto qualifier? If so, why isn't (a properly escaped) 'ether proto \ip host host' legal (no and)?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

In ether proto \ip "\ip" is the ID. That ether proto \ip means the same like ip on the content level does not mean that both has to be syntactically equivalent.

share|improve this answer
    
Thanks for posting an answer! I should have come back here and referred to the question I later posted on the tcpdump-workers list. Here is the corresponding answer. –  eze Apr 22 '13 at 19:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.