Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Reading the manpage of tcpdump I found this example

tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'

but I don't understand it, especially the last part.

The tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 part filters all the packets having either the SYN or the FIN bit set.

What does not src and dst net localnet filter?

The explanation in the same manpage says

To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.

but in my opinion src is not an expression by itself.

share|improve this question
up vote 7 down vote accepted

You can parse the second part of that filter thusly

not ( (src and dest) net localnet )

It's shorthand for

not src net localnet and not dest net localnet
share|improve this answer
Thank you. I thought that in order to use logical operator (as and) I MUST HAVE a complete true or false expression in every side. If I write not(src net localnet and dst net localnet), does it have the same meaning? – JustTrying Nov 8 '12 at 8:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.