Filtering

You can modify the set of packets that rvtrace processes by supplying either the -filter parameter, or a combination of the -src, -dst, -addr, and -port parameters. Filter expressions specify the set of packets to process.

rvtrace uses the pcap facility to capture and filter packets. The tcpdump utility also uses pcap, so the syntax and semantics for rvtrace and tcpdump filter expressions are identical. Filter Expressions summarizes the subset of filter expressions that are relevant to rvtrace; for additional options, see documentation for tcpdump. (Disclaimer: pcap and tcpdump are not TIBCO products; we do not sell, support or document them.)

Each row of Filter Expressions constitutes an expr, and can be used in place of the syntax marker expr elsewhere in Filter Expressions, and in the parameter table for rvtrace.

When specifying a filter expression to an rvtrace parameter, enclose the expression in quotation marks (").

Filter Expressions
Element	Description
Host Expressions
`host` `host`	Process a packet if either the IP source or destination of the packet is `host`. Specify `host` as a name or an IP address.
`dst host` `host`	Process a packet if its IP destination is `host`.
`src host` `host`	Process a packet if its IP source is `host`.
Network Expressions
`net` `net`	Process a packet if either the IP source or destination of the packet is `net`. Specify `net` as a name or an IP network number.
`dst net` `net`	Process a packet if its IP destination is `net`.
`src net` `net`	Process a packet if its IP source is `net`.
Port or Service Expressions
`port` `port`	Process a packet if either the IP source or destination port of the packet is `port`. Specify `port` as a service name or a UDP port number.
`dst port` `port`	Process a packet if its IP destination port is `port`.
`src port` `port`	Process a packet if its IP source port is `port`.
Broadcast or Multicast Expressions
`ip broadcast` `ip broadcast` `expr`	Process a packet if it is an IP broadcast packet. If `expr` is present, then process the packet only if it also meets the criteria of `expr`.
`ip multicast` `ip multicast` `expr`	Process a packet if it is an IP multicast packet. If `expr` is present, then process the packet only if it also meets the criteria of `expr`.
Protocol Expressions
`udp` `udp` `expr`	Process a packet if it is an IP packet with protocol type `udp`. (All Rendezvous packets are UDP packets.) If `expr` is present, then process the packet only if it also meets the criteria of `expr`.
`ip` `ip` `expr`	Process a packet if it is an IP packet. If `expr` is present, then process the packet only if it also meets the criteria of `expr`.
Boolean Operators Use parentheses to group boolean expressions; use appropriate escape characters to override shell-specific semantics of parentheses.
`expr1` `and` `expr2` `expr1` `expr2`	Process a packet if it meets both criteria.
`expr1` `or` `expr2`	Process a packet if it meets either criterion.
`not` `expr`	Process a packet if it does not meet the criterion.

Did you find this helpful?

Yes No