Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Reading the manpage of tcpdump I found this example

tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'

but I don't understand it, especially the last part.

The tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 part filters all the packets having either the SYN or the FIN bit set.

What does not src and dst net localnet filter?

The explanation in the same manpage says

To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.

but in my opinion src is not an expression by itself.

share|improve this question
add comment

1 Answer 1

up vote 6 down vote accepted

You can parse the second part of that filter thusly

not ( (src and dest) net localnet )

It's shorthand for

not src net localnet and not dest net localnet
share|improve this answer
    
Thank you. I thought that in order to use logical operator (as and) I MUST HAVE a complete true or false expression in every side. If I write not(src net localnet and dst net localnet), does it have the same meaning? –  JustTrying Nov 8 '12 at 8:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.