tcpdump 过滤掉特定的 ip 和该 ip 的特定端口

Question

我想用 tcpdump 过滤掉几个特定的​​ IP 和端口。

example 192.168.1.100 port 1111
        192.168.1.101 port 3333

我知道tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111一个 IP 有效。 tcpdump -i ens192 not dst host 192.168.1.100 or 192.168.1.101 and dst port port 1111 or 3333查找任意组合。但是您如何指定 .100 仅过滤掉 1111 和 .101 仅过滤掉 3333

谢谢！

Answer 1

使用括号：

not ((dst host 192.168.1.100 and dst port 1111) or (dst host 192.168.1.101 and dst port 3333))

Answer 2

括号是你的好朋友。来自man pcap-filter：

    Primitives may be combined using:

      A parenthesized group of primitives and operators.

      Negation (`!' or `not').

      Concatenation (`&&' or `and').

      Alternation (`||' or `or').

   Negation has highest precedence.  Alternation and concatenation have equal precedence and associate left to right.   Note  that  explicit
   and tokens, not juxtaposition, are now required for concatenation.

   If an identifier is given without a keyword, the most recent keyword is assumed.  For example,
        not host vs and ace
   is short for
        not host vs and host ace
   which should not be confused with
        not ( host vs or ace )

因此，类似下面的方法应该可以解决问题：

'!(dst host 192.168.1.100 and dst port 1111) && !(dst host 192.168.1.101 and dst port 3333)'

这是假设您只关心示例中的目的地。