Reading the manpage of
tcpdump I found this example
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'
but I don't understand it, especially the last part.
tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 part filters all the packets having either the SYN or the FIN bit set.
not src and dst net localnet filter?
The explanation in the same manpage says
To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
but in my opinion
src is not an expression by itself.