The following part of the man page is excerpted from the tcpdump man page. If no expression is given, all packets on the net will be dumped. The expression consists of one or more primitives. Possible types are host , net and port . If there is no type qualifier, host is assumed.
Possible directions are src , dst , src or dst and src and dst .
If there is no dir qualifier, src or dst is assumed. If there is no proto qualifier, all protocols consistent with the type are assumed. All of these are described below. More complex filter expressions are built up by using the words and , or and not to combine primitives. To save typing, identical qualifier lists can be omitted.