Berkeley Package Filters (BPF)

Can be used in:

Syntax

The following filters can be used and combined:

host <IP>: Filters visible traffic involving the designated host (bi-directional).
src/dest <host|net|port> <IP|Network Range>: Designate a source or destination host or port.
net: Shows traffic sourced from or destined to the designated network (uses / notation).
<protocol name>/proto <protocol number>: Filters for a specific protocol type (e.g., ether, tcp/6, upd/17, icmp/1).
port <port number>: Filters traffic with the specified port as source or destination (bi-directional).
portrange <low-high>: Specifies a range of ports (e.g., 0-1024) to filter traffic.
less/greater <size in bytes>: Filters for packets that are less/greater than a specified size.
and/&&: Combines two filters with an AND condition (both must be true).
or/||: Combines two filters with an OR condition (either can be true).
not/!: Negates a filter, that is shows anything except what is specified (e.g., “not UDP”).
‘<protocol name>[a] &b !=/== <value>’: Count to the byte number a in the protocol structure and from there look at byte number b to determine if it is different or equal to <value>.