Windows Networking Tools

291

MONITORING WITH WIRESHARK AND WINDUMP

Table7.3 Popular WinDump Primitives

PRIMITIVE DESCRIPTION

dst host host True if the IPv4/6 destination field of the packet matches the host

either as an IP address or hostname

drc host host True if the IPv4/6 source field of the packet is host

host host True if either the IPv4/6 source or destination of the packet is host

Note: You can prefix any of the above host expressions with the keywords ip, arp, rarp, or ip6.

ether dst ehost True if the Ethernet destination is ehost, which can be a name or

number

ether src ehost True if the Ethernet source address is ehost

ether host ehost True if either the Ethernet source ...