tcpdump filtering out specific ips and specific ports with that ip
I want to filter out several specific ips and ports with tcpdump.
example 192.168.1.100 port 1111
192.168.1.101 port 3333
I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111
work for the one ip.
tcpdump -i ens192 not dst host 192.168.1.100 or 192.168.1.101 and dst port port 1111 or 3333
looks for any combination. But how you do specify .100 only filtering out 1111 and .101 only filtering out 3333
Thanks!
use parenthesis:
not ((dst host 192.168.1.100 and dst port 1111) or (dst host 192.168.1.101 and dst port 3333))
Parentheses are your friend. From man pcap-filter
:
Primitives may be combined using:
A parenthesized group of primitives and operators.
Negation (`!' or `not').
Concatenation (`&&' or `and').
Alternation (`||' or `or').
Negation has highest precedence. Alternation and concatenation have equal precedence and associate left to right. Note that explicit
and tokens, not juxtaposition, are now required for concatenation.
If an identifier is given without a keyword, the most recent keyword is assumed. For example,
not host vs and ace
is short for
not host vs and host ace
which should not be confused with
not ( host vs or ace )
So, something similar to the following should do the trick:
'!(dst host 192.168.1.100 and dst port 1111) && !(dst host 192.168.1.101 and dst port 3333)'
This is assuming you're only concerned about destination in your examples.