Note that tcpdump does not currently know how to parse these protocols. Proto is one of ether, fddi, ip, arp, rarp, tcp, udp, or icmp , and indicates the protocol layer for the index operation. The byte offset, relative to the indicated protocol layer, is given by expr . The length operator, indicated by the keyword len , gives the length of the packet. This check is implicitly applied to the tcp and udp index operations.
Negation has highest precedence.
Alternation and concatenation have equal precedence and associate left to right. Note that explicit and tokens, not juxtaposition, are now required for concatenation. If an identifier is given without a keyword, the most recent keyword is assumed. Expression arguments can be passed to tcpdump as either a single argument or as multiple arguments, whichever is more convenient. Generally, if the expression contains Shell metacharacters, it is easier to pass it as a single, quoted argument.