tcpdump filtering out specific ips and specific ports with that ip

I want to filter out several specific ips and ports with tcpdump.

example 192.168.1.100 port 1111
        192.168.1.101 port 3333

I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111 work for the one ip. tcpdump -i ens192 not dst host 192.168.1.100 or 192.168.1.101 and dst port port 1111 or 3333 looks for any combination. But how you do specify .100 only filtering out 1111 and .101 only filtering out 3333

Thanks!


use parenthesis:

not ((dst host 192.168.1.100 and dst port 1111) or (dst host 192.168.1.101 and dst port 3333))

Parentheses are your friend. From man pcap-filter:

    Primitives may be combined using:

      A parenthesized group of primitives and operators.

      Negation (`!' or `not').

      Concatenation (`&&' or `and').

      Alternation (`||' or `or').

   Negation has highest precedence.  Alternation and concatenation have equal precedence and associate left to right.   Note  that  explicit
   and tokens, not juxtaposition, are now required for concatenation.

   If an identifier is given without a keyword, the most recent keyword is assumed.  For example,
        not host vs and ace
   is short for
        not host vs and host ace
   which should not be confused with
        not ( host vs or ace )

So, something similar to the following should do the trick:

'!(dst host 192.168.1.100 and dst port 1111) && !(dst host 192.168.1.101 and dst port 3333)'

This is assuming you're only concerned about destination in your examples.