An extended regular expression follows the rules as implemented by the GNU regex library . If no bpf filter is given, all IP packets seen on the selected interface will be dumped. The bpf filter consists of one or more primitives. Possible types are host , net and port . If there is no type qualifier, host is assumed.
Possible directions are src , dst , src or dst and src and dst .
If there is no dir qualifier, src or dst is assumed. If there is no proto qualifier, all protocols consistent with the type are assumed. All of these are described below. More complex filter expressions are built up by using the words and , or and not to combine primitives. To save typing, identical qualifier lists can be omitted.