Reference for the original blog

pcap_compile()

  This is used to compile the user input filter string to filter information, which can determine which packages are user acquisition.

Filter expressions contain one or more elements. Each element typically contains three different modifiers: 3 different modes of modified ID name or numbers:

  Type modifier Note The ID belongs to that type. The type of modifier that can be used is Host, Net, Port, Portrange. For example, 'Host Foo', 'Net 128.3', 'Port 20', 'POR-TRANGE 6000-6008'. If the ID does not specify a type, Host is the default.

  Path direction modifier Specify the path direction of the ID. The path modifiers that can be used include SRC, DST, SRC OR DST, SRCAND DST, ADDR1, ADDR2, ADDR3, AND AddR4. Example 'SRC Foo', 'DST NET 128.3', 'SRC or DST Port FTP-DATA'. If ID has no path modifier, default SRC or DST. Addr1, addr2, addr3, and addr4 are only for unlimited networks, in the link layer, if it is a mixed mode, you can specify the filter direction with inBound, OutBound.

  Agreement modifier To limit the matching protocol. Protocol modifiers Ether, FDDI, TR, WLAN, IP, IP6, ARP, RARP, DECNET, TCP AND UDP. Example Ether SRC FOO ',' ARP NET 128.3 ',' TCP Port 21 ',' UDP PortRange 7000-7009 ',' WLAN Addr2 0: 2: 3: 4: 5: 6 '. If there is no agreement, the default is All protocols match, such as 'src foo', IP ARP RARP protocols match
The FDDI protocol is equivalent to the Ether protocol, like the FDDI parser, like the Ether meaning, the FDDI header information contains an Ethernet source, destination address, and the type of destination, which can specify the FDDI header domain to filter the designated domain. . The FDDI head also contains other domains, but cannot be applied and filtered.
TR and WLANs are equivalent to Ether in the filter parser. The previous version of the FDDI header information is also applicable to the head of the 802.11 wireless LAN.

In addition to the above three modifiers, there are some special modifications and arithmetic computing: Gateway, Broadcast, Less, Greater.

  The arithmetic operation as shown below:
Combined complex filter expressions can be combined with and, or, not. For example, 'Host foo and not port ftp and not port ftp-data', if multiple expressions are combined in AND, or, NOT, multiple expressions have the same modifiers, and they can omit the first expression. For example, 'TCP DST port ftp or ftp-data or domain' is equivalent to 'TCP DST Port FTP or TCP DST PORT FTP-DATA or TCP DSTPORT DOMAIN'