Filter
Top Products
Table B-1. Allowable Primitives (Continued)
Primitive Explanation
ether proto protocol True if the packet is of ether type protocol. Protocol can be a number or one of the
names ip, ip6, arp, rarp, atalk, aarp, decnet, sca, lat, mopdl, moprc, iso, stp, ipx,
or netbeui.
Note: Note these identifiers are also keywords and must be escaped via
backslash (\).
[In the case of FDDI (e.g., ”fddi protocol arp') and Token Ring (e.g., ”tr
protocol arp'), for most of those protocols, the protocol identification comes from
the 802.2 Logical Link Control (LLC) header, which is usually layered on top of the
FDDI or Token Ring header.
When filtering for most protocol identifiers on FDDI or Token Ring, tcpdump checks
only the protocol ID field of an LLC header in so-called SNAP format with an
Organizational Unit Identifier (OUI) of 0x000000, for encapsulated Ethernet; it doesn't
check whether the packet is in SNAP format with an OUI of 0x000000. The exceptions
are:
• iso, for which it checks the DSAP (Destination Service Access Point) and SSAP
(Source Service Access Point) fields of the LLC header
• stp and netbeui, for which it checks the DSAP of the LLC header
• atalk, for which it checks for a SNAP-format packet with an OUI of 0x080007 and
the Appletalk etype
In the case of Ethernet, tcpdump checks the Ethernet type field for most of those
protocols; the exceptions are:
• iso, sap, and netbeui, for which it checks for an 802.3 frame and then checks the
LLC header as it does for FDDI and Token Ring
• atalk, for which it checks both for the Appletalk etype in an Ethernet frame and for a
SNAP-format packet as it does for FDDI and Token Ring
• aarp, for which it checks for the Appletalk ARP etype in either an Ethernet frame or
an 802.2 SNAP frame with an OUI of 0x000000,
• ipx, for which it checks for the IPX etype in an Ethernet frame, the IPX DSAP in the
LLC header, the 802.3 with no LLC header encapsulation of IPX, and the IPX etype
in a SNAP frame.]
vlan [vlan_id] True if the packet is an IEEE 802.1Q VLAN packet. If [vlan_id] is specified, then this
is only true if the packet has the specified vlan_id. Note that the first vlan keyword
encountered in expression changes the decoding offsets for the remainder of the
expression on the assumption that the packet is a VLAN packet.
tcp, udp, icmp Abbreviations for ip proto p or ip6 proto p, where p is one of the above protocols.
HP ProCurve Secure Access 700wl Series Management and Configuration Guide B-5