Operands are subexpressions, path expressions, C integer constants, or protocol-specific strings. NetVisualyzer has many one-word macros and protocol-specific strings that you can use as simple filters. You can also, if necessary, define your own macros. The subsections that follow give brief descriptions of each type of operand you can use.

ip.src == yeti and ip.dst == squaw

define(name, def)

An operator specifies an operation to be performed, such as addition or subtraction. All C operators except the assignment operators and ?: are supported. In addition, these simplifications are provided:

Other characteristics of filter syntax are:

Table 10-1 gives the list of operators you can use in filters. They are listed in order of highest to lowest precedence. Unless otherwise noted in the table, operators have left-to-right associativity. Parentheses can be used to specify precedence.

Several NetVisualyzer tools print a “corrected” version of your filter. This corrected version contains parentheses and operators that were implied in the original version. These corrected versions are printed so that you can verify the filter; they don't imply that there was an error. If a filter contains a syntax error, an error message is given.

First, take a look at the IP diagram shown in Figure 10-1. (Diagrams for all protocols are in Appendix C, “Protocols.”) The diagram illustrates the IP relationship to other network layers when the physical layer is Ethernet.

Figure 10-1. IP Protocol Diagram

Suppose you want to capture packets using the IP protocol. In this case, you can use a simple filter, ip. As another example, suppose that you want to capture packets using the TCP protocol. The filter for this protocol is ip.tcp. This filter is ip.tcp because each layer above the physical layer must be qualified with the protocol it is defined in. The physical layer, such as ether or fddi, is implied by the type of the interface you are snooping on. You could also use tcp as the filter because the ether protocol defines tcp as a macro whose definition is ip.tcp.

Figure 10-1 shows some of the protocols that an IP packet can contain. Assuming that the packet comes over an Ethernet interface, each packet is of the protocol ether and ip. Many of these packets will also contain other protocols above IP such as UDP or TCP.

To capture NFS packets, refer to Figure 10-1 to see which protocols are used by the NFS packet: ether, ip, udp, sunrpc, and nfs. You would therefore use ip.udp.sunrpc.nfs as the filter. You can also use the filter nfs because nfs is a predefined macro that expands to ip.udp.sunrpc.nfs.

This section explains how you can use NetSnoop to find NetVisualyzer protocol-specific strings, macros, and so forth. To see these, use netsnoop with the –L option. The syntax is:

netsnoop -L [ all | protocol ...]

With the –L option, NetSnoop lists information about the options and symbols defined by the protocol(s). all lists information for all protocols, and protocol is a protocol name, such as ip. You need not be superuser or have authorization to use NetSnoop when you use the –L option.

For example, to list IP information, type:

netsnoop -L ip 

The screen displays lists of fields, protocols, functions, macros, constants, and so forth. An example of the IP information looks similar to this output:.

ip (Internet Protocol):

  o Field               type                level     title
    v                   u_int:4             -vv       Version
    hl                  u_int:4             -vv       Header Length
    tos                 u_char              -vv       Type of Service
    len                 u_short             -v        Total Length
    id                  u_short             -v        Identification
    off                 u_short             -v        Fragment Offset
    ttl                 u_char              -vv       Time to Live
    p                   u_char              -vv       Protocol
    sum                 u_short             -vv       Header Checksum
    src                 u_long              -         Source Address
    dst                 u_long              -         Destination Address
    opt                 u_char              -v        Option Type
    optlen              u_char              -vv       Option Length
    rtoff               u_char              -vv       Route Offset
    rthop               u_long              -         Route Address
    tsptr               u_char              -vv       Timestamp Pointer
    tsoflw              u_int:4             -vv       Timestamp Overflow
    tsflg               u_int:4             -vv       Timestamp Flag
    tstime              u_long              -v        Timestamp Time
    tsaddr              u_long              -         Timestamp Address

  o Protocol            typecode  (decimal)
    hello               0x003f    63
    icmp                0x0001    1
    igmp                0x0002    2
    tcp                 0x0006    6
    udp                 0x0011    17

  o Function            description
    badsum              Match packet if header checksum is incorrect

  o Macro               definition
    HELLO               hello
    ICMP                icmp
    IGMP                igmp
    NFS                 udp.sunrpc.nfs
    TCP                 tcp
    UDP                 udp
    between             src == $1 && dst == $2 || dst == $1 && src == $2
    host                src == $1 || dst == $1
    nfs                 udp.sunrpc.nfs

  o Constant            value     (hexadecimal)
    BROADCAST           -1        ffffffff
    DF                  16384     4000
    EOL                 0         0
    LSRR                131       83
    MAXPRIVPORT         1023      3ff
    MF                  8192      2000
    MINHL               20        14
    MINUSERPORT         5001      1389
    MSS                 576       240
    NOP                 1         1
    RR                  7         7
    SATID               136       88
    SECURITY            130       82
    SSRR                137       89
    TS                  68        44

  o Option              description
    etherupdate         Update Ethernet hostname/address cache
    hostbyname          Decode IP addresses into hostnames
    hostresorder        Hostname resolution order; see resolver(4)

The first column of each section of the output consists of words that you can use in filter expressions. For example, you can create the filter:

ip.dst = BROADCAST 

where ip is the protocol name, dst is from the Field section, and BROADCAST is a Constant.

This output contains Field, Protocol, Function, Macro, Constant sections that are described briefly in Table 10-2. The next subsections explain each section of the output in detail and how you can use the information in them.

ip.dst=nodename 

ip.dst=indiana 

ip.src=gary 

ip.src=192.26.75.10 

host    src = host1 or dst = host1 

netsnoop -L ether fddi ip llc 

Suppose that you want to capture only packets using the IP protocol. The filter expression looks like this:

ip

This simple filter captures every packet that has the IP layer embedded in it. When you use this filter with Analyzer, the Summary window displays:

Seq     Time      Len      Source          Port      Destination    Port   Type
  4 09:17:01.61    60 rachel.wpd.sgi.com   1017   eno.wpd.sgi.com   1016   tcp

Notice that the Type column, which tells the type of packet captured, shows that a tcp packet was captured, not an ip packet. This is because the tcp packet has ip embedded in it. Next, output in the Detail window looks like this:

ether          Ethernet
          src        Source Address                        2:cf:1f:11:1:51/CMC
          dst        Destination Address                   8:00:69:1:9:7e/SGI
          type       Packet Type                           ip
ip             Internet Protocol
          v          Version                               4
          hl         Header Length                         5
          tos        Type of Service                       0
          len        Total Length                          552
          id         Identification                        61487
          off        Fragment Offset                       0
          ttl        Time to Live                          29
          p          Protocol                              tcp
          sum        Header Checksum                       0xaef3
          src        Source address                        gary.wpd.sgi.com
          dst        Destination Address                   192.26.56.11
tcp            Transmission Control Protocol
          sport      Source Port                           514 (shell)
          dport      Destination Port                      1023
          seq        Sequence Number                       966,794,335
          ack        Acknowledgement Number                28,226,517
          off        Data Offset                           5
          flags      Flags                                 ACK
          win        Window                                24,576
          sum        Checksum                              0xc004
          urp        Urgent Pointer                        0

Notice how the output of this window displays the Field section information for each protocol that was captured. This display also uses the full name description (taken from the “title” column of netsnoop -L output).

To create a filter that captures only TCP or UDP data, use protocol filters. Protocol filters are found in the Protocol section of the output of netsnoop -L. For TCP and UDP, which are higher level protocols of IP, the netsnoop command is netsnoop -L ip. The output includes the protocols tcp and udp. To create the filter, enter:

ip.tcp or ip.udp

The output of Analyzer with this filter shows ether and ip information (shown in the previous example) and udp and dns information:

...
udp            User Datagram Protocol
          sport      Source Port                           53 (dns)
          dport      Destination Port                      53 (dns)
          len        Length                                52
          sum        Checksum                              0z686e
dns            Domain Name System Protocol
          id         Identifier                            43212
          qr         Query/Response Flag                   0 (query)
          opcode     Operation Code                        QUERY
          aa         Authoritative Answer                  0
          tc         Truncation                            0
...

Suppose you want to constrict the filter to see TCP or UDP packets coming to or from an IP host named gary. Use the protocols tcp and udp and the host macro defined for IP to construct a filter like this:

(tcp or udp) and ip.host gary

or you can use a longer filter:

(tcp or udp) and (ip.src=gary or ip.dst=gary)

You must include parentheses to ensure the correct order of evaluation. This time the filter isolated data to and from gary. In addition to ether and ip information, the Detail window lists the udp information that was captured:

...
udp            User Datagram Protocol
          sport      Source Port                           525 (timed)
          dport      Destination Port                      525 (timed)
          len        Length                                84
          sum        Checksum                              0xe28b

Perhaps you want to capture only TCP or UDP packets between nodes named gary and indiana. This filter uses the between macro defined for IP:

(tcp or udp) and ip.between gary indiana

You can achieve the same result by using a longer filter:

(tcp or udp) and (ip.src=gary and ip.dst=indiana or ip.dst=gary and ip.src=indiana)

A header field is prepended by IRIX when packets delivered to the snoop socket are received. This header consists of the following data:

To see a list of header fields and errors you can capture, type:

netsnoop -L snoop

You can use the words in the Field and Constant sections of the output in filter expressions. For example, to capture packets with a length less than 100 bytes, use the filter:

snoop.len < 100

Perhaps you want to capture errors on the network. As described in the previous subsection, a list of errors to capture appears in the Field column that you see when you type:

netsnoop -L snoop

Types of errors include “frame,” “checksum,” “toobig,” “toosmall,” and “nobufs.” You can use these error types in a filter expression. For example, to capture framing errors, use the filter:

snoop.frame

To capture all errors, enter the filter:

snoop.error

For a description of flags and errors, see “Capture Options” in Chapter 5.

Suppose your workstation, with a physical (Ethernet) address of 8:0:69:2:9:2f, serves as a router on the network. To capture all Ethernet packets to and from this router, use the host macro:

host 8:0:69:2:9:2f

You do not need to precede this macro with the protocol name. If you use a macro to capture ether packets, the protocol (ether) is understood and you must supply the physical address and not the symbolic name unless the name is in /etc/ethers.

To capture remote logins (rlogin(1)) between two nodes named buffalo and newyork, use the filter:

ip.between buffalo newyork and rlogin

Use string in a filter expression to obtain a string from a protocol. For example, you want to capture the string “hello” and you know it begins at byte 38 in the packet. To do so, use the filter:

string(5,38) == "hello"

where (5,38) specifies the size to capture (5 bytes) and where to begin the capture. 38 is the offset (offsets begin at 0), which specifies the place to start capturing (position 39 in the packet). You can use \x01 and \001 to represent hex and octal.

An easy way to determine the offset is to use Analyzer. Highlight the field you wish to see in the Detail pane. The Hex Dump panes hexadecimal characters that correspond to the field also become highlighted. Thus you can determine the offset of a field by counting (from left to right) the number of bytes.

Use fetch in a filter expression to obtain information from a protocol that is not currently supported or to obtain information that is in the data content portion of the packet.

For example, suppose your site runs a proprietary protocol over UDP. The first byte of your proprietary protocol represents a count of users logged in on the sending system. The UDP header consists of 8 bytes, so the eighth byte from the start of UDP is your count. To capture packets only from systems that your proprietary protocol reports one user is on, enter:

udp.fetch(1,8) == 1

where (1,8) specifies the size to capture (1 byte) and the offset 8 (where to begin the capture), and 1 specifies one user.