没有合适的资源?快使用搜索试试~ 我知道了~
首页Berkeley Packet Filter (BPF) syntax
资源详情
资源评论
资源推荐
9/28/2016 BPFsyntax
http://biot.com/capstats/bpf.html 1/10
BerkeleyPacketFilter(BPF)syntax
The expression consists of one or more primitives. Primitives usually consist of an id (name or number)
precededbyoneormorequalifiers.Therearethreedifferentkindsofqualifier:
type
qualifierssaywhatkindofthingtheidnameornumberrefersto.Possibletypesarehost,net, port
and portrange. E.g., `host foo', `net 128.3', `port 20', `portrange 60006008'. If there is no type
qualifier,hostisassumed.
dir
qualifiersspecifyaparticulartransferdirectiontoand/orfromid.Possibledirectionsaresrc, dst,src
ordstandsrcand dst. E.g., `src foo', `dst net 128.3', `src or dst port ftpdata'. If there is no dir
qualifier,srcordstisassumed.Forsomelinklayers,suchasSLIPandthe``cooked''Linuxcapture
mode used for the ``any'' device and for some other device types, the inbound and outbound
qualifierscanbeusedtospecifyadesireddirection.
proto
qualifiersrestrictthematchtoaparticularprotocol.Possibleprotosare:ether,fddi,tr,wlan, ip,ip6,
arp,rarp,decnet, tcp and udp. E.g., `ether src foo', `arp net 128.3', `tcp port 21', `udp portrange
70007009'.Ifthereisnoprotoqualifier,allprotocolsconsistentwiththetypeareassumed.E.g.,`src
foo'means`(iporarporrarp)srcfoo'(exceptthelatterisnotlegalsyntax),`netbar'means`(iporarp
orrarp)netbar'and`port53'means`(tcporudp)port53'.
`fddi'isactuallyanaliasfor`ether';theparsertreatsthemidenticallyasmeaning``thedatalinklevelusedon
thespecifiednetworkinterface.''FDDIheaderscontainEthernetlikesourceanddestinationaddresses,and
oftencontainEthernetlikepackettypes, soyoucanfilteronthese FDDI fields justaswiththeanalogous
Ethernet fields. FDDI headers also contain other fields, but you cannot name them explicitly in a filter
expression.
Similarly,`tr'and`wlan'arealiasesfor`ether';thepreviousparagraph'sstatementsaboutFDDIheadersalso
apply to TokenRingand802.11 wirelessLAN headers. For802.11 headers,the destination address is the
DAfieldandthesourceaddressistheSAfield;theBSSID,RA,andTAfieldsaren'ttested.
Inadditiontotheabove,therearesomespecial`primitive'keywordsthatdon'tfollowthepattern:gateway,
broadcast,less,greaterandarithmeticexpressions.Allofthesearedescribedbelow.
Morecomplexfilterexpressionsarebuiltupbyusingthewordsand,orandnottocombineprimitives.E.g.,
`hostfooandnotportftpandnotportftpdata'.Tosavetyping,identicalqualifierlistscanbeomitted.E.g.,
`tcpdstportftporftpdataordomain'isexactlythesameas`tcpdstportftportcpdstportftpdataortcp
dstportdomain'.
Allowableprimitivesare:
dsthosthost
TrueiftheIPv4/v6destinationfieldofthepacketishost,whichmaybeeitheranaddressoraname.
srchosthost
TrueiftheIPv4/v6sourcefieldofthepacketishost.
hosthost
TrueifeithertheIPv4/v6sourceordestinationofthepacketishost.
Anyoftheabovehostexpressionscanbeprependedwiththekeywords,ip,arp,rarp,orip6asin:
zangchang
- 粉丝: 4
- 资源: 23
上传资源 快速赚钱
- 我的内容管理 收起
- 我的资源 快来上传第一个资源
- 我的收益 登录查看自己的收益
- 我的积分 登录查看自己的积分
- 我的C币 登录后查看C币余额
- 我的收藏
- 我的下载
- 下载帮助
会员权益专享
最新资源
- 27页智慧街道信息化建设综合解决方案.pptx
- 计算机二级Ms-Office选择题汇总.doc
- 单链表的插入和删除实验报告 (2).docx
- 单链表的插入和删除实验报告.pdf
- 物联网智能终端项目设备管理方案.pdf
- 如何打造品牌的模式.doc
- 样式控制与页面布局.pdf
- 武汉理工Java实验报告(二).docx
- 2021线上新品消费趋势报告.pdf
- 第3章 Matlab中的矩阵及其运算.docx
- 基于Web的人力资源管理系统的必要性和可行性.doc
- 基于一阶倒立摆的matlab仿真实验.doc
- 速运公司物流管理模式研究教材
- 大数据与管理.pptx
- 单片机课程设计之步进电机.doc
- 大数据与数据挖掘.pptx
资源上传下载、课程学习等过程中有任何疑问或建议,欢迎提出宝贵意见哦~我们会及时处理!
点击此处反馈
安全验证
文档复制为VIP权益,开通VIP直接复制
信息提交成功
评论1