Home/ Questions/Q 8291025
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T12:59:27+00:00

I was wondering how the input data in this expression actually works. char *filter

  • 0

I was wondering how the input data in this expression actually works. 

char *filter = "dst host 172.17.14.90 and ip";

From what I understand the dest host bit and the following IPv4 address defines what address the recieved packet should be addressed to.

The man page was a bit confusing on that point saying:

dst host host
True if the IPv4/v6 destination field of the packet is host,
which may be either an address or a name.

http://www.manpagez.com/man/7/pcap-filter/

so is that what it means? and as for the and ip bit I have no clue.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You are right about the first bit:

    dst host 172.17.14.90

    means that the packet should be addressed to 172.17.14.90.

    The second one:

    ip

    like the manpage says is an abbreviation for:

    ether proto ip

    which means that the packet must be sent using the IP protocol.

    So, to sum up: the packet must be sent using the IP protocol to the host having IP address 172.17.14.90.

    As a note, the above could be expressed simpler using:

    ip dst host 172.17.14.90

    (the shorter syntax is explained near host explanation in the manpage)

    • 0