Dump num packets of trailing context after matching a packet. A match expression is either an extended regular expression, or if the -X option is specified, a string signifying a hexadecimal value. An extended regular expression follows the rules as implemented by the GNU regex library . If no bpf filter is given, all IP packets seen on the selected interface will be dumped. The bpf filter consists of one or more primitives.
Possible types are host , net and port .
If there is no type qualifier, host is assumed. Possible directions are src , dst , src or dst and src and dst . If there is no dir qualifier, src or dst is assumed. If there is no proto qualifier, all protocols consistent with the type are assumed. All of these are described below.