Ethereal filter rules

Capture Filter)
I. There are two types of filter rules
Primitive)
One is an expression formed by combining the primitive with the Relational operators "and", "or", "not", and parentheses "()".
Ii. IP address filtering
1. Capture packets whose source or destination IP address is "210.30.97.53"
IP. ADDR = 172.22.16.16

2. Capture all packets whose destination IP address is "2172.22.16.16"
IP. dst = 172.22.16.16

3. Miscellaneous
! (IP. ADDR = 172.22.16.16)
IP. src = 172.22.16.16, indicating that the source address is 172.22.16.16
IP. dst = 172.22.16.16, indicating that the target address is 172.22.16.16
IP. src eq 172.22.16.16 displays the source IP address
IP. dst EQ 172.22.16.16 display target IP Address
Iii. Port Filtering
1. Capture TCP packets whose source or destination port number is 53
TCP. Port = 53 only capture DNS data
TCP. Port = 80 capture all web browsing packets
2. Capture all UDP packets whose destination port number is 1812
UDP. dstport = 1812
3. Filter port range
TCP. Port> = 1 and TCP. Port <= 80
3. Miscellaneous
TCP. dstport = 80
UDP. srcport = 1812
TCP. Flags. SYN = 0x02 display packets containing the tcp syn flag
Iv. Protocol Filtering
Syntax: ARP | IP | ICMP | UDP | TCP | UDP | HTTP | SMTP | FTP | DNS | msnms | SSL
1. Capture all ARP packets
ARP
5. Package Length Filtering
UDP. Length = 26 This length refers to the fixed length of UDP itself 8 plus the sum of the packets under UDP
TCP. Len> = 7 refers to the IP packet (the piece of data below TCP), excluding the TCP itself
IP. Len = 94 except for the fixed length 14 of the Ethernet header, all others are IP. Len, that is, from the IP address itself to the last
Frame. Len = 119 the length of the entire packet, starting from ETH to the end
Vi. http mode filtering
HTTP. Request. Method = "get"
HTTP. Request. Method = "Post"
HTTP. Request. uri = "/img/logo-edu.gif"
HTTP contains "get"
HTTP contains "HTTP/1 ."
// Get package
HTTP. Request. Method = "get" & HTTP contains "Host :"
HTTP. Request. Method = "get" & HTTP contains "User-Agent :"
// Post package
HTTP. Request. Method = "Post" & HTTP contains "Host :"
HTTP. Request. Method = "Post" & HTTP contains "User-Agent :"
// Response package
HTTP contains "HTTP/1.1 200 OK" & HTTP contains "Content-Type :"
HTTP contains "HTTP/1.0 200 OK" & HTTP contains "Content-Type :"
VII. Connector
And or not
8. Expressions

9. MAC address filtering
1. packets whose target MAC address is 00: 18: 8B: 8f: ED: 7b
Eth. dst EQ 00: 18: 8B: 8f: ED: 7b
2. Miscellaneous
Eth. src eq 00: 18: 8B: 8f: ED: 7b
Eth. addr eq 00: 18: 8B: 8f: ED: 7b