"Fossies" - the Fresh Open Source Software Archive

Member "libpcap-1.10.1/./pcap-filter.manmisc.in" (7 Jun 2021, 35522 Bytes) of package /linux/misc/libpcap-1.10.1.tar.gz:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. See also the latest Fossies "Diffs" side-by-side code changes report for "pcap-filter.manmisc.in": 1.10.0_vs_1.10.1.

    1 .\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
    2 .\"	The Regents of the University of California.  All rights reserved.
    3 .\" All rights reserved.
    4 .\"
    5 .\" Redistribution and use in source and binary forms, with or without
    6 .\" modification, are permitted provided that: (1) source code distributions
    7 .\" retain the above copyright notice and this paragraph in its entirety, (2)
    8 .\" distributions including binary code include the above copyright notice and
    9 .\" this paragraph in its entirety in the documentation or other materials
   10 .\" provided with the distribution, and (3) all advertising materials mentioning
   11 .\" features or use of this software display the following acknowledgement:
   12 .\" ``This product includes software developed by the University of California,
   13 .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
   14 .\" the University nor the names of its contributors may be used to endorse
   15 .\" or promote products derived from this software without specific prior
   16 .\" written permission.
   17 .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
   18 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
   19 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
   20 .\"
   21 .TH PCAP-FILTER @MAN_MISC_INFO@ "6 February 2021"
   22 .SH NAME
   23 pcap-filter \- packet filter syntax
   24 .br
   25 .ad
   26 .SH DESCRIPTION
   27 .LP
   28 .BR pcap_compile ()
   29 is used to compile a string into a filter program.
   30 The resulting filter program can then be applied to
   31 some stream of packets to determine which packets will be supplied to
   32 .BR pcap_loop (3PCAP),
   33 .BR pcap_dispatch (3PCAP),
   34 .BR pcap_next (3PCAP),
   35 or
   36 .BR pcap_next_ex (3PCAP).
   37 .LP
   38 The \fIfilter expression\fP consists of one or more
   39 .IR primitives .
   40 Primitives usually consist of an
   41 .I id
   42 (name or number) preceded by one or more qualifiers.
   43 There are three
   44 different kinds of qualifier:
   45 .IP \fItype\fP
   46 .I type
   47 qualifiers say what kind of thing the id name or number refers to.
   48 Possible types are
   49 .BR host ,
   50 .BR net ,
   51 .B port
   52 and
   53 .BR portrange .
   54 E.g., `\fBhost\fP foo', `\fBnet\fP 128.3', `\fBport\fP 20', `\fBportrange\fP 6000-6008'.
   55 If there is no type
   56 qualifier,
   57 .B host
   58 is assumed.
   59 .IP \fIdir\fP
   60 .I dir
   61 qualifiers specify a particular transfer direction to and/or from
   62 .IR id .
   63 Possible directions are
   64 .BR src ,
   65 .BR dst ,
   66 .BR "src or dst" ,
   67 .BR "src and dst" ,
   68 .BR ra ,
   69 .BR ta ,
   70 .BR addr1 ,
   71 .BR addr2 ,
   72 .BR addr3 ,
   73 and
   74 .BR addr4 .
   75 E.g., `\fBsrc\fP foo', `\fBdst net\fP 128.3', `\fBsrc or dst port\fP ftp-data'.
   76 If
   77 there is no dir qualifier, `\fBsrc or dst\fP' is assumed.
   78 The
   79 .BR ra ,
   80 .BR ta ,
   81 .BR addr1 ,
   82 .BR addr2 ,
   83 .BR addr3 ,
   84 and
   85 .B addr4
   86 qualifiers are only valid for IEEE 802.11 Wireless LAN link layers.
   87 .IP \fIproto\fP
   88 .I proto
   89 qualifiers restrict the match to a particular protocol.
   90 Possible
   91 protos are:
   92 .BR ether ,
   93 .BR fddi ,
   94 .BR tr ,
   95 .BR wlan ,
   96 .BR ip ,
   97 .BR ip6 ,
   98 .BR arp ,
   99 .BR rarp ,
  100 .BR decnet ,
  101 .B tcp
  102 and
  103 .BR udp .
  104 E.g., `\fBether src\fP foo', `\fBarp net\fP 128.3', `\fBtcp port\fP 21',
  105 `\fBudp portrange\fP 7000-7009', `\fBwlan addr2\fP 0:2:3:4:5:6'.
  106 If there is
  107 no proto qualifier, all protocols consistent with the type are
  108 assumed.
  109 E.g., `\fBsrc\fP foo' means `\fB(ip or arp or rarp) src\fP foo'
  110 (except the latter is not legal syntax), `\fBnet\fP bar' means `\fB(ip or
  111 arp or rarp) net\fP bar' and `\fBport\fP 53' means `\fB(tcp or udp)
  112 port\fP 53'.
  113 .LP
  114 [\fBfddi\fP is actually an alias for \fBether\fP; the parser treats them
  115 identically as meaning ``the data link level used on the specified
  116 network interface''.  FDDI headers contain Ethernet-like source
  117 and destination addresses, and often contain Ethernet-like packet
  118 types, so you can filter on these FDDI fields just as with the
  119 analogous Ethernet fields.
  120 FDDI headers also contain other fields,
  121 but you cannot name them explicitly in a filter expression.
  122 .LP
  123 Similarly, \fBtr\fP and \fBwlan\fP are aliases for \fBether\fP; the previous
  124 paragraph's statements about FDDI headers also apply to Token Ring
  125 and 802.11 wireless LAN headers.  For 802.11 headers, the destination
  126 address is the DA field and the source address is the SA field; the
  127 BSSID, RA, and TA fields aren't tested.]
  128 .LP
  129 In addition to the above, there are some special `primitive' keywords
  130 that don't follow the pattern:
  131 .BR gateway ,
  132 .BR broadcast ,
  133 .BR less ,
  134 .B greater
  135 and arithmetic expressions.
  136 All of these are described below.
  137 .LP
  138 More complex filter expressions are built up by using the words
  139 .BR and ,
  140 .B or
  141 and
  142 .B not
  143 (or equivalently: `\fB&&\fP', `\fB||\fP' and `\fB!\fP' respectively)
  144 to combine primitives.
  145 E.g., `\fBhost\fP foo \fBand not port\fP ftp \fBand not port\fP ftp-data'.
  146 To save typing, identical qualifier lists can be omitted.
  147 E.g.,
  148 `\fBtcp dst port\fP ftp \fBor\fP ftp-data \fBor\fP domain' is exactly the same as
  149 `\fBtcp dst port\fP ftp \fBor tcp dst port\fP ftp-data \fBor tcp dst port\fP domain'.
  150 .LP
  151 Allowable primitives are:
  152 .IP "\fBdst host \fIhost\fR"
  153 True if the IPv4/v6 destination field of the packet is \fIhost\fP,
  154 which may be either an address or a name.
  155 .IP "\fBsrc host \fIhost\fR"
  156 True if the IPv4/v6 source field of the packet is \fIhost\fP.
  157 .IP "\fBhost \fIhost\fP"
  158 True if either the IPv4/v6 source or destination of the packet is \fIhost\fP.
  159 .IP
  160 Any of the above host expressions can be prepended with the keywords,
  161 \fBip\fP, \fBarp\fP, \fBrarp\fP, or \fBip6\fP as in:
  162 .in +.5i
  163 .nf
  164 \fBip host \fIhost\fR
  165 .fi
  166 .in -.5i
  167 which is equivalent to:
  168 .in +.5i
  169 .nf
  170 \fBether proto \\ip and host \fIhost\fR
  171 .fi
  172 .in -.5i
  173 If \fIhost\fR is a name with multiple IPv4 addresses, each address will
  174 be checked for a match.
  175 .IP "\fBether dst \fIehost\fP"
  176 True if the Ethernet destination address is \fIehost\fP.
  177 \fIEhost\fP
  178 may be either a name from /etc/ethers or a numerical MAC address of the
  179 form "xx:xx:xx:xx:xx:xx", "xx.xx.xx.xx.xx.xx", "xx-xx-xx-xx-xx-xx",
  180 "xxxx.xxxx.xxxx", "xxxxxxxxxxxx", or various mixes of ':', '.', and '-',
  181 where each "x" is a hex digit (0-9, a-f, or A-F).
  182 .IP "\fBether src \fIehost\fP"
  183 True if the Ethernet source address is \fIehost\fP.
  184 .IP "\fBether host \fIehost\fP"
  185 True if either the Ethernet source or destination address is \fIehost\fP.
  186 .IP "\fBgateway\fP \fIhost\fP"
  187 True if the packet used \fIhost\fP as a gateway.
  188 I.e., the Ethernet
  189 source or destination address was \fIhost\fP but neither the IP source
  190 nor the IP destination was \fIhost\fP.
  191 \fIHost\fP must be a name and
  192 must be found both by the machine's host-name-to-IP-address resolution
  193 mechanisms (host name file, DNS, NIS, etc.) and by the machine's
  194 host-name-to-Ethernet-address resolution mechanism (/etc/ethers, etc.).
  195 (An equivalent expression is
  196 .in +.5i
  197 .nf
  198 \fBether host \fIehost \fBand not host \fIhost\fR
  199 .fi
  200 .in -.5i
  201 which can be used with either names or numbers for \fIhost / ehost\fP.)
  202 This syntax does not work in IPv6-enabled configuration at this moment.
  203 .IP "\fBdst net \fInet\fR"
  204 True if the IPv4/v6 destination address of the packet has a network
  205 number of \fInet\fP.
  206 \fINet\fP may be either a name from the networks database
  207 (/etc/networks, etc.) or a network number.
  208 An IPv4 network number can be written as a dotted quad (e.g., 192.168.1.0),
  209 dotted triple (e.g., 192.168.1), dotted pair (e.g, 172.16), or single
  210 number (e.g., 10); the netmask is 255.255.255.255 for a dotted quad
  211 (which means that it's really a host match), 255.255.255.0 for a dotted
  212 triple, 255.255.0.0 for a dotted pair, or 255.0.0.0 for a single number.
  213 An IPv6 network number must be written out fully; the netmask is
  214 ff:ff:ff:ff:ff:ff:ff:ff, so IPv6 "network" matches are really always
  215 host matches, and a network match requires a netmask length.
  216 .IP "\fBsrc net \fInet\fR"
  217 True if the IPv4/v6 source address of the packet has a network
  218 number of \fInet\fP.
  219 .IP "\fBnet \fInet\fR"
  220 True if either the IPv4/v6 source or destination address of the packet has a network
  221 number of \fInet\fP.
  222 .IP "\fBnet \fInet\fR \fBmask \fInetmask\fR"
  223 True if the IPv4 address matches \fInet\fR with the specific \fInetmask\fR.
  224 May be qualified with \fBsrc\fR or \fBdst\fR.
  225 Note that this syntax is not valid for IPv6 \fInet\fR.
  226 .IP "\fBnet \fInet\fR/\fIlen\fR"
  227 True if the IPv4/v6 address matches \fInet\fR with a netmask \fIlen\fR
  228 bits wide.
  229 May be qualified with \fBsrc\fR or \fBdst\fR.
  230 .IP "\fBdst port \fIport\fR"
  231 True if the packet is IPv4 TCP, IPv4 UDP, IPv6 TCP or IPv6 UDP and has a
  232 destination port value of \fIport\fP.
  233 The \fIport\fP can be a number or a name used in /etc/services (see
  234 .BR tcp (4P)
  235 and
  236 .BR udp (4P)).
  237 If a name is used, both the port
  238 number and protocol are checked.
  239 If a number or ambiguous name is used,
  240 only the port number is checked (e.g., `\fBdst port\fR 513' will print both
  241 tcp/login traffic and udp/who traffic, and `\fBport domain\fR' will print
  242 both tcp/domain and udp/domain traffic).
  243 .IP "\fBsrc port \fIport\fR"
  244 True if the packet has a source port value of \fIport\fP.
  245 .IP "\fBport \fIport\fR"
  246 True if either the source or destination port of the packet is \fIport\fP.
  247 .IP "\fBdst portrange \fIport1-port2\fR"
  248 True if the packet is IPv4 TCP, IPv4 UDP, IPv6 TCP or IPv6 UDP and has a
  249 destination port value between \fIport1\fP and \fIport2\fP (both inclusive).
  250 .I port1
  251 and
  252 .I port2
  253 are interpreted in the same fashion as the
  254 .I port
  255 parameter for
  256 .BR port .
  257 .IP "\fBsrc portrange \fIport1-port2\fR"
  258 True if the packet has a source port value between \fIport1\fP and
  259 \fIport2\fP (both inclusive).
  260 .IP "\fBportrange \fIport1-port2\fR"
  261 True if either the source or destination port of the packet is between
  262 \fIport1\fP and \fIport2\fP (both inclusive).
  263 .IP
  264 Any of the above port or port range expressions can be prepended with
  265 the keywords, \fBtcp\fP or \fBudp\fP, as in:
  266 .in +.5i
  267 .nf
  268 \fBtcp src port \fIport\fR
  269 .fi
  270 .in -.5i
  271 which matches only TCP packets whose source port is \fIport\fP.
  272 .IP "\fBless \fIlength\fR"
  273 True if the packet has a length less than or equal to \fIlength\fP.
  274 This is equivalent to:
  275 .in +.5i
  276 .nf
  277 \fBlen <= \fIlength\fP
  278 .fi
  279 .in -.5i
  280 .IP "\fBgreater \fIlength\fR"
  281 True if the packet has a length greater than or equal to \fIlength\fP.
  282 This is equivalent to:
  283 .in +.5i
  284 .nf
  285 \fBlen >= \fIlength\fP
  286 .fi
  287 .in -.5i
  288 .IP "\fBip proto \fIprotocol\fR"
  289 True if the packet is an IPv4 packet (see
  290 .BR ip (4P))
  291 of protocol type \fIprotocol\fP.
  292 \fIProtocol\fP can be a number or one of the names
  293 \fBicmp\fP, \fBicmp6\fP, \fBigmp\fP, \fBigrp\fP, \fBpim\fP, \fBah\fP,
  294 \fBesp\fP, \fBvrrp\fP, \fBudp\fP, or \fBtcp\fP.
  295 Note that the identifiers \fBtcp\fP, \fBudp\fP, and \fBicmp\fP are also
  296 keywords and must be escaped via backslash (\\).
  297 Note that this primitive does not chase the protocol header chain.
  298 .IP "\fBip6 proto \fIprotocol\fR"
  299 True if the packet is an IPv6 packet of protocol type \fIprotocol\fP.
  300 Note that this primitive does not chase the protocol header chain.
  301 .IP "\fBproto \fIprotocol\fR"
  302 True if the packet is an IPv4 or IPv6 packet of protocol type
  303 \fIprotocol\fP.  Note that this primitive does not chase the protocol
  304 header chain.
  305 .IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
  306 Abbreviations for:
  307 .in +.5i
  308 .nf
  309 \fBproto \\\fIprotocol\fR\fB
  310 .fi
  311 .in -.5i
  312 where \fIprotocol\fR is one of the above protocols.
  313 .IP "\fBip6 protochain \fIprotocol\fR"
  314 True if the packet is IPv6 packet,
  315 and contains protocol header with type \fIprotocol\fR
  316 in its protocol header chain.
  317 For example,
  318 .in +.5i
  319 .nf
  320 \fBip6 protochain\fR 6
  321 .fi
  322 .in -.5i
  323 matches any IPv6 packet with TCP protocol header in the protocol header chain.
  324 The packet may contain, for example,
  325 authentication header, routing header, or hop-by-hop option header,
  326 between IPv6 header and TCP header.
  327 The BPF code emitted by this primitive is complex and
  328 cannot be optimized by the BPF optimizer code, and is not supported by
  329 filter engines in the kernel, so this can be somewhat slow, and may
  330 cause more packets to be dropped.
  331 .IP "\fBip protochain \fIprotocol\fR"
  332 Equivalent to \fBip6 protochain \fIprotocol\fR, but this is for IPv4.
  333 .IP "\fBprotochain \fIprotocol\fR"
  334 True if the packet is an IPv4 or IPv6 packet of protocol type
  335 \fIprotocol\fP.  Note that this primitive chases the protocol
  336 header chain.
  337 .IP "\fBether broadcast\fR"
  338 True if the packet is an Ethernet broadcast packet.
  339 The \fBether\fP
  340 keyword is optional.
  341 .IP "\fBip broadcast\fR"
  342 True if the packet is an IPv4 broadcast packet.
  343 It checks for both the all-zeroes and all-ones broadcast conventions,
  344 and looks up the subnet mask on the interface on which the capture is
  345 being done.
  346 .IP
  347 If the subnet mask of the interface on which the capture is being done
  348 is not available, either because the interface on which capture is being
  349 done has no netmask or because the capture is being done on the Linux
  350 "any" interface, which can capture on more than one interface, this
  351 check will not work correctly.
  352 .IP "\fBether multicast\fR"
  353 True if the packet is an Ethernet multicast packet.
  354 The \fBether\fP
  355 keyword is optional.
  356 This is shorthand for `\fBether[\fP0\fB] & \fP1\fB != \fP0'.
  357 .IP "\fBip multicast\fR"
  358 True if the packet is an IPv4 multicast packet.
  359 .IP "\fBip6 multicast\fR"
  360 True if the packet is an IPv6 multicast packet.
  361 .IP  "\fBether proto \fIprotocol\fR"
  362 True if the packet is of ether type \fIprotocol\fR.
  363 \fIProtocol\fP can be a number or one of the names
  364 \fBaarp\fP, \fBarp\fP, \fBatalk\fP, \fBdecnet\fP, \fBip\fP, \fBip6\fP,
  365 \fBipx\fP, \fBiso\fP, \fBlat\fP, \fBloopback\fP, \fBmopdl\fP, \fBmoprc\fP, \fBnetbeui\fP,
  366 \fBrarp\fP, \fBsca\fP or \fBstp\fP.
  367 Note these identifiers (except \fBloopback\fP) are also keywords
  368 and must be escaped via backslash (\\).
  369 .IP
  370 [In the case of FDDI (e.g., `\fBfddi proto \\arp\fR'), Token Ring
  371 (e.g., `\fBtr proto \\arp\fR'), and IEEE 802.11 wireless LANs (e.g.,
  372 `\fBwlan proto \\arp\fR'), for most of those protocols, the
  373 protocol identification comes from the 802.2 Logical Link Control (LLC)
  374 header, which is usually layered on top of the FDDI, Token Ring, or
  375 802.11 header.
  376 .IP
  377 When filtering for most protocol identifiers on FDDI, Token Ring, or
  378 802.11, the filter checks only the protocol ID field of an LLC header
  379 in so-called SNAP format with an Organizational Unit Identifier (OUI) of
  380 0x000000, for encapsulated Ethernet; it doesn't check whether the packet
  381 is in SNAP format with an OUI of 0x000000.
  382 The exceptions are:
  383 .RS
  384 .TP
  385 \fBiso\fP
  386 the filter checks the DSAP (Destination Service Access Point) and
  387 SSAP (Source Service Access Point) fields of the LLC header;
  388 .TP
  389 \fBstp\fP and \fBnetbeui\fP
  390 the filter checks the DSAP of the LLC header;
  391 .TP
  392 \fBatalk\fP
  393 the filter checks for a SNAP-format packet with an OUI of 0x080007
  394 and the AppleTalk etype.
  395 .RE
  396 .IP
  397 In the case of Ethernet, the filter checks the Ethernet type field
  398 for most of those protocols.  The exceptions are:
  399 .RS
  400 .TP
  401 \fBiso\fP, \fBstp\fP, and \fBnetbeui\fP
  402 the filter checks for an 802.3 frame and then checks the LLC header as
  403 it does for FDDI, Token Ring, and 802.11;
  404 .TP
  405 \fBatalk\fP
  406 the filter checks both for the AppleTalk etype in an Ethernet frame and
  407 for a SNAP-format packet as it does for FDDI, Token Ring, and 802.11;
  408 .TP
  409 \fBaarp\fP
  410 the filter checks for the AppleTalk ARP etype in either an Ethernet
  411 frame or an 802.2 SNAP frame with an OUI of 0x000000;
  412 .TP
  413 \fBipx\fP
  414 the filter checks for the IPX etype in an Ethernet frame, the IPX
  415 DSAP in the LLC header, the 802.3-with-no-LLC-header encapsulation of
  416 IPX, and the IPX etype in a SNAP frame.
  417 .RE
  418 .IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fBnetbeui\fP"
  419 Abbreviations for:
  420 .in +.5i
  421 .nf
  422 \fBether proto \\\fIprotocol\fR
  423 .fi
  424 .in -.5i
  425 where \fIprotocol\fR is one of the above protocols.
  426 .IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
  427 Abbreviations for:
  428 .in +.5i
  429 .nf
  430 \fBether proto \\\fIprotocol\fR
  431 .fi
  432 .in -.5i
  433 where \fIprotocol\fR is one of the above protocols.
  434 Note that not all applications using
  435 .BR pcap (3PCAP)
  436 currently know how to parse these protocols.
  437 .IP "\fBdecnet src \fIhost\fR"
  438 True if the DECnet source address is
  439 .IR host ,
  440 which may be an address of the form ``10.123'', or a DECnet host
  441 name.
  442 [DECnet host name support is only available on ULTRIX systems
  443 that are configured to run DECnet.]
  444 .IP "\fBdecnet dst \fIhost\fR"
  445 True if the DECnet destination address is
  446 .IR host .
  447 .IP "\fBdecnet host \fIhost\fR"
  448 True if either the DECnet source or destination address is
  449 .IR host .
  450 .IP \fBllc\fP
  451 True if the packet has an 802.2 LLC header.  This includes:
  452 .IP
  453 Ethernet packets with a length field rather than a type field that
  454 aren't raw NetWare-over-802.3 packets;
  455 .IP
  456 IEEE 802.11 data packets;
  457 .IP
  458 Token Ring packets (no check is done for LLC frames);
  459 .IP
  460 FDDI packets (no check is done for LLC frames);
  461 .IP
  462 LLC-encapsulated ATM packets, for SunATM on Solaris.
  463 .IP "\fBllc\fP \fItype\fR"
  464 True if the packet has an 802.2 LLC header and has the specified
  465 .IR type .
  466 .I type
  467 can be one of:
  468 .RS
  469 .TP
  470 \fBi\fR
  471 Information (I) PDUs
  472 .TP
  473 \fBs\fR
  474 Supervisory (S) PDUs
  475 .TP
  476 \fBu\fR
  477 Unnumbered (U) PDUs
  478 .TP
  479 \fBrr\fR
  480 Receiver Ready (RR) S PDUs
  481 .TP
  482 \fBrnr\fR
  483 Receiver Not Ready (RNR) S PDUs
  484 .TP
  485 \fBrej\fR
  486 Reject (REJ) S PDUs
  487 .TP
  488 \fBui\fR
  489 Unnumbered Information (UI) U PDUs
  490 .TP
  491 \fBua\fR
  492 Unnumbered Acknowledgment (UA) U PDUs
  493 .TP
  494 \fBdisc\fR
  495 Disconnect (DISC) U PDUs
  496 .TP
  497 \fBsabme\fR
  498 Set Asynchronous Balanced Mode Extended (SABME) U PDUs
  499 .TP
  500 \fBtest\fR
  501 Test (TEST) U PDUs
  502 .TP
  503 \fBxid\fR
  504 Exchange Identification (XID) U PDUs
  505 .TP
  506 \fBfrmr\fR
  507 Frame Reject (FRMR) U PDUs
  508 .RE
  509 .IP \fBinbound\fP
  510 Packet was received by the host performing the capture rather than being
  511 sent by that host.  This is only supported for certain link-layer types,
  512 such as SLIP and the ``cooked'' Linux capture mode
  513 used for the ``any'' device and for some other device types.
  514 .IP \fBoutbound\fP
  515 Packet was sent by the host performing the capture rather than being
  516 received by that host.  This is only supported for certain link-layer types,
  517 such as SLIP and the ``cooked'' Linux capture mode
  518 used for the ``any'' device and for some other device types.
  519 .IP "\fBifname \fIinterface\fR"
  520 True if the packet was logged as coming from the specified interface (applies
  521 only to packets logged by OpenBSD's or FreeBSD's
  522 .BR pf (4)).
  523 .IP "\fBon \fIinterface\fR"
  524 Synonymous with the
  525 .B ifname
  526 modifier.
  527 .IP "\fBrnr \fInum\fR"
  528 True if the packet was logged as matching the specified PF rule number
  529 (applies only to packets logged by OpenBSD's or FreeBSD's
  530 .BR pf (4)).
  531 .IP "\fBrulenum \fInum\fR"
  532 Synonymous with the
  533 .B rnr
  534 modifier.
  535 .IP "\fBreason \fIcode\fR"
  536 True if the packet was logged with the specified PF reason code.  The known
  537 codes are:
  538 .BR match ,
  539 .BR bad-offset ,
  540 .BR fragment ,
  541 .BR short ,
  542 .BR normalize ,
  543 and
  544 .B memory
  545 (applies only to packets logged by OpenBSD's or FreeBSD's
  546 .BR pf (4)).
  547 .IP "\fBrset \fIname\fR"
  548 True if the packet was logged as matching the specified PF ruleset
  549 name of an anchored ruleset (applies only to packets logged by OpenBSD's
  550 or FreeBSD's
  551 .BR pf (4)).
  552 .IP "\fBruleset \fIname\fR"
  553 Synonymous with the
  554 .B rset
  555 modifier.
  556 .IP "\fBsrnr \fInum\fR"
  557 True if the packet was logged as matching the specified PF rule number
  558 of an anchored ruleset (applies only to packets logged by OpenBSD's or
  559 FreeBSD's
  560 .BR pf (4)).
  561 .IP "\fBsubrulenum \fInum\fR"
  562 Synonymous with the
  563 .B srnr
  564 modifier.
  565 .IP "\fBaction \fIact\fR"
  566 True if PF took the specified action when the packet was logged.  Known actions
  567 are:
  568 .B pass
  569 and
  570 .B block
  571 and, with later versions of
  572 .BR pf (4),
  573 .BR nat ,
  574 .BR rdr ,
  575 .B binat
  576 and
  577 .B scrub
  578 (applies only to packets logged by OpenBSD's or FreeBSD's
  579 .BR pf (4)).
  580 .IP "\fBwlan ra \fIehost\fR"
  581 True if the IEEE 802.11 RA is
  582 .IR ehost .
  583 The RA field is used in all frames except for management frames.
  584 .IP "\fBwlan ta \fIehost\fR"
  585 True if the IEEE 802.11 TA is
  586 .IR ehost .
  587 The TA field is used in all frames except for management frames and
  588 CTS (Clear To Send) and ACK (Acknowledgment) control frames.
  589 .IP "\fBwlan addr1 \fIehost\fR"
  590 True if the first IEEE 802.11 address is
  591 .IR ehost .
  592 .IP "\fBwlan addr2 \fIehost\fR"
  593 True if the second IEEE 802.11 address, if present, is
  594 .IR ehost .
  595 The second address field is used in all frames except for CTS (Clear To
  596 Send) and ACK (Acknowledgment) control frames.
  597 .IP "\fBwlan addr3 \fIehost\fR"
  598 True if the third IEEE 802.11 address, if present, is
  599 .IR ehost .
  600 The third address field is used in management and data frames, but not
  601 in control frames.
  602 .IP "\fBwlan addr4 \fIehost\fR"
  603 True if the fourth IEEE 802.11 address, if present, is
  604 .IR ehost .
  605 The fourth address field is only used for
  606 WDS (Wireless Distribution System) frames.
  607 .IP "\fBtype \fIwlan_type\fR"
  608 True if the IEEE 802.11 frame type matches the specified \fIwlan_type\fR.
  609 Valid \fIwlan_type\fRs are:
  610 \fBmgt\fP,
  611 \fBctl\fP
  612 and \fBdata\fP.
  613 .IP "\fBtype \fIwlan_type \fBsubtype \fIwlan_subtype\fR"
  614 True if the IEEE 802.11 frame type matches the specified \fIwlan_type\fR
  615 and frame subtype matches the specified \fIwlan_subtype\fR.
  616 .IP
  617 If the specified \fIwlan_type\fR is \fBmgt\fP,
  618 then valid \fIwlan_subtype\fRs are:
  619 \fBassoc-req\fP,
  620 \fBassoc-resp\fP,
  621 \fBreassoc-req\fP,
  622 \fBreassoc-resp\fP,
  623 \fBprobe-req\fP,
  624 \fBprobe-resp\fP,
  625 \fBbeacon\fP,
  626 \fBatim\fP,
  627 \fBdisassoc\fP,
  628 \fBauth\fP and
  629 \fBdeauth\fP.
  630 .IP
  631 If the specified \fIwlan_type\fR is \fBctl\fP,
  632 then valid \fIwlan_subtype\fRs are:
  633 \fBps-poll\fP,
  634 \fBrts\fP,
  635 \fBcts\fP,
  636 \fBack\fP,
  637 \fBcf-end\fP and
  638 \fBcf-end-ack\fP.
  639 .IP
  640 If the specified \fIwlan_type\fR is \fBdata\fP,
  641 then valid \fIwlan_subtype\fRs are:
  642 \fBdata\fP,
  643 \fBdata-cf-ack\fP,
  644 \fBdata-cf-poll\fP,
  645 \fBdata-cf-ack-poll\fP,
  646 \fBnull\fP,
  647 \fBcf-ack\fP,
  648 \fBcf-poll\fP,
  649 \fBcf-ack-poll\fP,
  650 \fBqos-data\fP,
  651 \fBqos-data-cf-ack\fP,
  652 \fBqos-data-cf-poll\fP,
  653 \fBqos-data-cf-ack-poll\fP,
  654 \fBqos\fP,
  655 \fBqos-cf-poll\fP and
  656 \fBqos-cf-ack-poll\fP.
  657 .IP "\fBsubtype \fIwlan_subtype\fR"
  658 True if the IEEE 802.11 frame subtype matches the specified \fIwlan_subtype\fR
  659 and frame has the type to which the specified \fIwlan_subtype\fR belongs.
  660 .IP "\fBdir \fIdir\fR"
  661 True if the IEEE 802.11 frame direction matches the specified
  662 .IR dir .
  663 Valid directions are:
  664 .BR nods ,
  665 .BR tods ,
  666 .BR fromds ,
  667 .BR dstods ,
  668 or a numeric value.
  669 .IP "\fBvlan \fI[vlan_id]\fR"
  670 True if the packet is an IEEE 802.1Q VLAN packet.
  671 If the optional \fIvlan_id\fR is specified, only true if the packet has the specified
  672 \fIvlan_id\fR.
  673 Note that the first \fBvlan\fR keyword encountered in an expression
  674 changes the decoding offsets for the remainder of the expression on
  675 the assumption that the packet is a VLAN packet.  The `\fBvlan
  676 \fI[vlan_id]\fR` keyword may be used more than once, to filter on VLAN
  677 hierarchies.  Each use of that keyword increments the filter offsets
  678 by 4.
  679 .IP
  680 For example:
  681 .in +.5i
  682 .nf
  683 \fBvlan\fP 100 \fB&& vlan\fR 200
  684 .fi
  685 .in -.5i
  686 filters on VLAN 200 encapsulated within VLAN 100, and
  687 .in +.5i
  688 .nf
  689 \fBvlan && vlan \fP300 \fB&& ip\fR
  690 .fi
  691 .in -.5i
  692 filters IPv4 protocol encapsulated in VLAN 300 encapsulated within any
  693 higher order VLAN.
  694 .IP "\fBmpls \fI[label_num]\fR"
  695 True if the packet is an MPLS packet.
  696 If the optional \fIlabel_num\fR is specified, only true if the packet has the specified
  697 \fIlabel_num\fR.
  698 Note that the first \fBmpls\fR keyword encountered in an expression
  699 changes the decoding offsets for the remainder of the expression on
  700 the assumption that the packet is a MPLS-encapsulated IP packet.  The
  701 `\fBmpls \fI[label_num]\fR` keyword may be used more than once, to
  702 filter on MPLS hierarchies.  Each use of that keyword increments the
  703 filter offsets by 4.
  704 .IP
  705 For example:
  706 .in +.5i
  707 .nf
  708 \fBmpls\fP 100000 \fB&& mpls\fR 1024
  709 .fi
  710 .in -.5i
  711 filters packets with an outer label of 100000 and an inner label of
  712 1024, and
  713 .in +.5i
  714 .nf
  715 \fBmpls && mpls\fP 1024 \fB&& host\fR 192.9.200.1
  716 .fi
  717 .in -.5i
  718 filters packets to or from 192.9.200.1 with an inner label of 1024 and
  719 any outer label.
  720 .IP \fBpppoed\fP
  721 True if the packet is a PPP-over-Ethernet Discovery packet (Ethernet
  722 type 0x8863).
  723 .IP "\fBpppoes \fI[session_id]\fR"
  724 True if the packet is a PPP-over-Ethernet Session packet (Ethernet
  725 type 0x8864).
  726 If the optional \fIsession_id\fR is specified, only true if the packet has the specified
  727 \fIsession_id\fR.
  728 Note that the first \fBpppoes\fR keyword encountered in an expression
  729 changes the decoding offsets for the remainder of the expression on
  730 the assumption that the packet is a PPPoE session packet.
  731 .IP
  732 For example:
  733 .in +.5i
  734 .nf
  735 \fBpppoes\fP 0x27 \fB&& ip\fR
  736 .fi
  737 .in -.5i
  738 filters IPv4 protocol encapsulated in PPPoE session id 0x27.
  739 .IP "\fBgeneve \fI[vni]\fR"
  740 True if the packet is a Geneve packet (UDP port 6081). If the optional \fIvni\fR
  741 is specified, only true if the packet has the specified \fIvni\fR.
  742 Note that when the \fBgeneve\fR keyword is encountered in
  743 an expression, it changes the decoding offsets for the remainder of
  744 the expression on the assumption that the packet is a Geneve packet.
  745 .IP
  746 For example:
  747 .in +.5i
  748 .nf
  749 \fBgeneve\fP 0xb \fB&& ip\fR
  750 .fi
  751 .in -.5i
  752 filters IPv4 protocol encapsulated in Geneve with VNI 0xb. This will
  753 match both IPv4 directly encapsulated in Geneve as well as IPv4 contained
  754 inside an Ethernet frame.
  755 .IP "\fBiso proto \fIprotocol\fR"
  756 True if the packet is an OSI packet of protocol type \fIprotocol\fP.
  757 \fIProtocol\fP can be a number or one of the names
  758 \fBclnp\fP, \fBesis\fP, or \fBisis\fP.
  759 .IP "\fBclnp\fR, \fBesis\fR, \fBisis\fR"
  760 Abbreviations for:
  761 .in +.5i
  762 .nf
  763 \fBiso proto \\\fIprotocol\fR
  764 .fi
  765 .in -.5i
  766 where \fIprotocol\fR is one of the above protocols.
  767 .IP "\fBl1\fR, \fBl2\fR, \fBiih\fR, \fBlsp\fR, \fBsnp\fR, \fBcsnp\fR, \fBpsnp\fR"
  768 Abbreviations for IS-IS PDU types.
  769 .IP "\fBvpi\fP \fIn\fR"
  770 True if the packet is an ATM packet, for SunATM on Solaris, with a
  771 virtual path identifier of
  772 .IR n .
  773 .IP "\fBvci\fP \fIn\fR"
  774 True if the packet is an ATM packet, for SunATM on Solaris, with a
  775 virtual channel identifier of
  776 .IR n .
  777 .IP \fBlane\fP
  778 True if the packet is an ATM packet, for SunATM on Solaris, and is
  779 an ATM LANE packet.
  780 Note that the first \fBlane\fR keyword encountered in an expression
  781 changes the tests done in the remainder of the expression
  782 on the assumption that the packet is either a LANE emulated Ethernet
  783 packet or a LANE LE Control packet.  If \fBlane\fR isn't specified, the
  784 tests are done under the assumption that the packet is an
  785 LLC-encapsulated packet.
  786 .IP \fBoamf4s\fP
  787 True if the packet is an ATM packet, for SunATM on Solaris, and is
  788 a segment OAM F4 flow cell (VPI=0 & VCI=3).
  789 .IP \fBoamf4e\fP
  790 True if the packet is an ATM packet, for SunATM on Solaris, and is
  791 an end-to-end OAM F4 flow cell (VPI=0 & VCI=4).
  792 .IP \fBoamf4\fP
  793 True if the packet is an ATM packet, for SunATM on Solaris, and is
  794 a segment or end-to-end OAM F4 flow cell (VPI=0 & (VCI=3 | VCI=4)).
  795 .IP \fBoam\fP
  796 True if the packet is an ATM packet, for SunATM on Solaris, and is
  797 a segment or end-to-end OAM F4 flow cell (VPI=0 & (VCI=3 | VCI=4)).
  798 .IP \fBmetac\fP
  799 True if the packet is an ATM packet, for SunATM on Solaris, and is
  800 on a meta signaling circuit (VPI=0 & VCI=1).
  801 .IP \fBbcc\fP
  802 True if the packet is an ATM packet, for SunATM on Solaris, and is
  803 on a broadcast signaling circuit (VPI=0 & VCI=2).
  804 .IP \fBsc\fP
  805 True if the packet is an ATM packet, for SunATM on Solaris, and is
  806 on a signaling circuit (VPI=0 & VCI=5).
  807 .IP \fBilmic\fP
  808 True if the packet is an ATM packet, for SunATM on Solaris, and is
  809 on an ILMI circuit (VPI=0 & VCI=16).
  810 .IP \fBconnectmsg\fP
  811 True if the packet is an ATM packet, for SunATM on Solaris, and is
  812 on a signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect,
  813 Connect Ack, Release, or Release Done message.
  814 .IP \fBmetaconnect\fP
  815 True if the packet is an ATM packet, for SunATM on Solaris, and is
  816 on a meta signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect,
  817 Release, or Release Done message.
  818 .IP  "\fIexpr relop expr\fR"
  819 True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =,
  820 !=, and \fIexpr\fR is an arithmetic expression composed of integer
  821 constants (expressed in standard C syntax), the normal binary operators
  822 [+, -, *, /, %, &, |, ^, <<, >>], a length operator, and special packet data
  823 accessors.  Note that all comparisons are unsigned, so that, for example,
  824 0x80000000 and 0xffffffff are > 0.
  825 .IP
  826 The % and ^ operators are currently only supported for filtering in the
  827 kernel on Linux with 3.7 and later kernels; on all other systems, if
  828 those operators are used, filtering will be done in user mode, which
  829 will increase the overhead of capturing packets and may cause more
  830 packets to be dropped.
  831 .IP
  832 To access data inside the packet, use the following syntax:
  833 .in +.5i
  834 .nf
  835 \fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
  836 .fi
  837 .in -.5i
  838 \fIProto\fR is one of \fBether, fddi, tr, wlan, ppp, slip, link,
  839 ip, arp, rarp, tcp, udp, icmp, ip6\fR or \fBradio\fR, and
  840 indicates the protocol layer for the index operation.
  841 (\fBether, fddi, wlan, tr, ppp, slip\fR and \fBlink\fR all refer to the
  842 link layer. \fBradio\fR refers to the "radio header" added to some
  843 802.11 captures.)
  844 Note that \fBtcp\fR, \fBudp\fR and other upper-layer protocol types only
  845 apply to IPv4, not IPv6 (this will be fixed in the future).
  846 The byte offset, relative to the indicated protocol layer, is
  847 given by \fIexpr\fR.
  848 \fISize\fR is optional and indicates the number of bytes in the
  849 field of interest; it can be either one, two, or four, and defaults to one.
  850 The length operator, indicated by the keyword \fBlen\fP, gives the
  851 length of the packet.
  852 
  853 For example, `\fBether[\fP0\fB] &\fP 1 \fB!=\fP 0' catches all multicast traffic.
  854 The expression `\fBip[\fP0\fB] &\fP 0xf \fB!=\fP 5'
  855 catches all IPv4 packets with options.
  856 The expression
  857 `\fBip[\fP6:2\fB] &\fP 0x1fff \fB=\fP 0'
  858 catches only unfragmented IPv4 datagrams and frag zero of fragmented
  859 IPv4 datagrams.
  860 This check is implicitly applied to the \fBtcp\fP and \fBudp\fP
  861 index operations.
  862 For instance, \fBtcp[\fP0\fB]\fP always means the first
  863 byte of the TCP \fIheader\fP, and never means the first byte of an
  864 intervening fragment.
  865 
  866 Some offsets and field values may be expressed as names rather than
  867 as numeric values.
  868 The following protocol header field offsets are
  869 available: \fBicmptype\fP (ICMP type field), \fBicmp6type\fP (ICMPv6 type field),
  870 \fBicmpcode\fP (ICMP code field), \fBicmp6code\fP (ICMPv6 code field) and
  871 \fBtcpflags\fP (TCP flags field).
  872 
  873 The following ICMP type field values are available: \fBicmp-echoreply\fP,
  874 \fBicmp-unreach\fP, \fBicmp-sourcequench\fP, \fBicmp-redirect\fP,
  875 \fBicmp-echo\fP, \fBicmp-routeradvert\fP, \fBicmp-routersolicit\fP,
  876 \fBicmp-timxceed\fP, \fBicmp-paramprob\fP, \fBicmp-tstamp\fP,
  877 \fBicmp-tstampreply\fP, \fBicmp-ireq\fP, \fBicmp-ireqreply\fP,
  878 \fBicmp-maskreq\fP, \fBicmp-maskreply\fP.
  879 
  880 The following ICMPv6 type fields are available: \fBicmp6-destinationrunreach\fP,
  881 \fBicmp6-packettoobig\fP, \fBicmp6-timeexceeded\fP,
  882 \fBicmp6-parameterproblem\fP, \fBicmp6-echo\fP,
  883 \fBicmp6-echoreply\fP, \fBicmp6-multicastlistenerquery\fP,
  884 \fBicmp6-multicastlistenerreportv1\fP, \fBicmp6-multicastlistenerdone\fP,
  885 \fBicmp6-routersolicit\fP, \fBicmp6-routeradvert\fP,
  886 \fBicmp6-neighborsolicit\fP, \fBicmp6-neighboradvert\fP, \fBicmp6-redirect\fP,
  887 \fBicmp6-routerrenum\fP, \fBicmp6-nodeinformationquery\fP,
  888 \fBicmp6-nodeinformationresponse\fP, \fBicmp6-ineighbordiscoverysolicit\fP,
  889 \fBicmp6-ineighbordiscoveryadvert\fP, \fBicmp6-multicastlistenerreportv2\fP,
  890 \fBicmp6-homeagentdiscoveryrequest\fP, \fBicmp6-homeagentdiscoveryreply\fP,
  891 \fBicmp6-mobileprefixsolicit\fP, \fBicmp6-mobileprefixadvert\fP,
  892 \fBicmp6-certpathsolicit\fP, \fBicmp6-certpathadvert\fP,
  893 \fBicmp6-multicastrouteradvert\fP, \fBicmp6-multicastroutersolicit\fP,
  894 \fBicmp6-multicastrouterterm\fP.
  895 
  896 The following TCP flags field values are available: \fBtcp-fin\fP,
  897 \fBtcp-syn\fP, \fBtcp-rst\fP, \fBtcp-push\fP,
  898 \fBtcp-ack\fP, \fBtcp-urg\fP, \fBtcp-ece\fP,
  899 \fBtcp-cwr\fP.
  900 .LP
  901 Primitives may be combined using:
  902 .IP
  903 A parenthesized group of primitives and operators.
  904 .IP
  905 Negation (`\fB!\fP' or `\fBnot\fP').
  906 .IP
  907 Concatenation (`\fB&&\fP' or `\fBand\fP').
  908 .IP
  909 Alternation (`\fB||\fP' or `\fBor\fP').
  910 .LP
  911 Negation has the highest precedence.
  912 Alternation and concatenation have equal precedence and associate
  913 left to right.
  914 Note that explicit \fBand\fR tokens, not juxtaposition,
  915 are now required for concatenation.
  916 .LP
  917 If an identifier is given without a keyword, the most recent keyword
  918 is assumed.
  919 For example,
  920 .in +.5i
  921 .nf
  922 \fBnot host\fP vs \fBand\fR ace
  923 .fi
  924 .in -.5i
  925 is short for
  926 .in +.5i
  927 .nf
  928 \fBnot host\fP vs \fBand host\fR ace
  929 .fi
  930 .in -.5i
  931 which should not be confused with
  932 .in +.5i
  933 .nf
  934 \fBnot (host \fPvs\fB or \fPace\fB)\fR
  935 .fi
  936 .in -.5i
  937 .SH EXAMPLES
  938 .LP
  939 To select all packets arriving at or departing from `sundown':
  940 .RS
  941 .nf
  942 \fBhost\fP sundown
  943 .fi
  944 .RE
  945 .LP
  946 To select traffic between `helios' and either `hot' or `ace':
  947 .RS
  948 .nf
  949 \fBhost\fP helios \fBand (\fPhot \fBor\fP ace\fB)\fP
  950 .fi
  951 .RE
  952 .LP
  953 To select all IPv4 packets between `ace' and any host except `helios':
  954 .RS
  955 .nf
  956 \fBip host\fP ace \fBand not\fP helios
  957 .fi
  958 .RE
  959 .LP
  960 To select all traffic between local hosts and hosts at Berkeley:
  961 .RS
  962 .nf
  963 \fBnet\fP ucb-ether
  964 .fi
  965 .RE
  966 .LP
  967 To select all FTP traffic through Internet gateway `snup':
  968 .RS
  969 .nf
  970 \fBgateway\fP snup \fBand (port\fP ftp \fBor\fP ftp-data\fB)\fP
  971 .fi
  972 .RE
  973 .LP
  974 To select IPv4 traffic neither sourced from nor destined for local hosts
  975 (if you gateway to one other net, this stuff should never make it
  976 onto your local net).
  977 .RS
  978 .nf
  979 \fBip and not net \fPlocalnet
  980 .fi
  981 .RE
  982 .LP
  983 To select the start and end packets (the SYN and FIN packets) of each
  984 TCP conversation that involves a non-local host.
  985 .RS
  986 .nf
  987 \fBtcp[tcpflags] & (tcp-syn|tcp-fin) !=\fP 0 \fBand not src and dst net\fP localnet
  988 .fi
  989 .RE
  990 .LP
  991 To select the TCP packets with flags RST and ACK both set.
  992 (i.e. select only the RST and ACK flags in the flags field, and if the result
  993 is "RST and ACK both set", match)
  994 .RS
  995 .nf
  996 .B
  997 tcp[tcpflags] & (tcp-rst|tcp-ack) == (tcp-rst|tcp-ack)
  998 .fi
  999 .RE
 1000 .LP
 1001 To select all IPv4 HTTP packets to and from port 80, i.e. print only
 1002 packets that contain data, not, for example, SYN and FIN packets and
 1003 ACK-only packets.  (IPv6 is left as an exercise for the reader.)
 1004 .RS
 1005 .nf
 1006 \fBtcp port\fP 80 \fBand (((ip[\fP2:2\fB] - ((ip[\fP0\fB]&\fP0xf\fB)<<\fP2\fB)) - ((tcp[\fP12\fB]&\fP0xf0\fB)>>\fP2\fB)) != \fP0\fB)
 1007 .fi
 1008 .RE
 1009 .LP
 1010 To select IPv4 packets longer than 576 bytes sent through gateway `snup':
 1011 .RS
 1012 .nf
 1013 \fBgateway\fP snup \fBand ip[\fP2:2\fB] >\fP 576
 1014 .fi
 1015 .RE
 1016 .LP
 1017 To select IPv4 broadcast or multicast packets that were
 1018 .I not
 1019 sent via Ethernet broadcast or multicast:
 1020 .RS
 1021 .nf
 1022 \fBether[\fP0\fB] &\fP 1 \fB=\fP 0 \fBand ip[\fP16\fB] >=\fP 224
 1023 .fi
 1024 .RE
 1025 .LP
 1026 To select all ICMP packets that are not echo requests/replies (i.e., not
 1027 ping packets):
 1028 .RS
 1029 .nf
 1030 .B
 1031 icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply
 1032 .B
 1033 icmp6[icmp6type] != icmp6-echo and icmp6[icmp6type] != icmp6-echoreply
 1034 .fi
 1035 .RE
 1036 .SH "SEE ALSO"
 1037 .BR pcap (3PCAP)
 1038 .SH BUGS
 1039 To report a security issue please send an e-mail to security@tcpdump.org.
 1040 .LP
 1041 To report bugs and other problems, contribute patches, request a
 1042 feature, provide generic feedback etc please see the file
 1043 .I CONTRIBUTING.md
 1044 in the libpcap source tree root.
 1045 .LP
 1046 Filter expressions on fields other than those in Token Ring headers will
 1047 not correctly handle source-routed Token Ring packets.
 1048 .LP
 1049 Filter expressions on fields other than those in 802.11 headers will not
 1050 correctly handle 802.11 data packets with both To DS and From DS set.
 1051 .LP
 1052 `\fBip6 proto\fP'
 1053 should chase header chain, but at this moment it does not.
 1054 `\fBip6 protochain\fP'
 1055 is supplied for this behavior.  For example, to match IPv6 fragments:
 1056 `\fBip6 protochain\fP 44'
 1057 .LP
 1058 Arithmetic expression against transport layer headers, like \fBtcp[0]\fP,
 1059 does not work against IPv6 packets.
 1060 It only looks at IPv4 packets.