If a name is used, both the port number and protocol are checked. True if the packet has a source port value of port . True if either the source or destination port of the packet is port . True if the packet has a length less than or equal to length . True if the packet has a length greater than or equal to length .
Protocol can be a number or one of the names icmp , igrp , udp , nd , or tcp .
The ether keyword is optional. The ether keyword is optional. True if the packet is an IP multicast packet. Protocol can be a number or a name like ip , arp , or rarp . Note that tcpdump does not currently know how to parse these protocols.