To configure structured filters, you simply write the conditions according to what we learned in the previous recipes, with conditions to meet your requirements.
Some common filters are:
- For capturing only unicast packets, configure not broadcast and not multicast
- For capturing HTTP packets to www.youtube.com, configure host www.youtube.com and port 80
- For a capture filter for telnet that captures traffic to and from a particular host, configure tcp port 23 and host 192.180.1.1
- For capturing all telnet traffic not from 192.168.1.1, configure tcp port 23 and not src host 192.168.1.1
- To capture packets to port 80 (HTTP) on servers 216.58.209.68 and 216.58.209.69, configure ((tcp) and (port 80) and ((dst host 216.58.209.68) ...