Filter = expr, expr and expr, expr or expr, not expr, ( expr ), not ( expr ). Expressions can
be connected with logical operators “and” or “or”, exclude data by applying operator “not”. Use
brackets for complex filters.
[src|dst] IP <ipaddr>or[src|dst] HOST <ipaddr> with <ipaddr> as
any valid IPv4 or IPv6 address. Omitting [src|dst] is equivalent to “SRC or DST” [src|dst] port [comp] <num> where <num> is a valid port number. [comp] is
comparator. [src|dst] port in [<portlist>] where <portlist> is a space separated list of
individual port numbers. [src|dst] net a.b.c.d m.n.r.s or [src|dst] net <net>/<num> Select the IPv4
network a.b.c.d with netmask m.n.r.s. or /nn [in|out] if <num> Select input or output or either interface ID, with num as the SNMP
interface number. [src|dst|prev|next] as [comp] <num> Selects source, destination, previous, next or any
AS number with <num> as any valid as number. Use 32-bit AS numbers. [src|dst|prev|next] as in [<ASlist>] An AS number can be compared against a know list,
where <ASlist> is a space or comma separated list of individual AS numbers. packets [comp] num, bytes [comp] num, pps [comp] num [scale] packets per second, bps
[comp] num [scale] bits per second, bpp [comp] num [scale] bytes per packet. scale
scaling factor (1024): (Kilo) K, (Mega) M, (Giga) G, (Terra) T. comp The following comparators are supported: =, ==, >, <, EQ, LT, GT . If comp is
omitted, '=' is assumed.
ip 192.168.2.4 - match specific IP address (both source and destination) ipv4 and (proto icmp or proto udp) - same (in this case order does not matter)> not (proto tcp or proto udp or proto icmp) - exclude TCP, UDP and ICMP communication
(explore ARP, ICMP6, IGMP and other protocols) ip in [192.168.2.3 192.168.2.4] and proto tcp - match only TCP communication of these
addresses src net 192.168.0.0 255.255.255.240 and not ip [192.168.0.14 192.168.0.15] - match IPs
192.168.0.0 to 192.168.0.13 src port < 1024 and not port in [80,443] - find well-known source ports (0 - 1023) in use,
but ignore HTTP(S) in if 3 - select input interface #3 flags S and not flags AFRPU or tcpflafs S - match records with only the SYN flag set packets > 1M and bytes < 1700M - match records with more than 1 mega packets, but under 1700
MB bpp > 1500 and bytes > 100M - find jumbo packets flows with over 100MB proto tcp and net 192.168/16 and src port > 1024 and dst port 80 and bytes > 2048 - match
HTTP/TCP communication in internal network larger than 2048 bytes duration > 1000 and duration < 5000 - match flow records which took between 1 and 5
seconds