Why isn't 'ether proto \ip host host' a legal tcpdump expression?
- by Ezequiel Garzon
In its description of valid tcpdump expressions, the pcap-filter man pages state:
The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by one or more qualifiers.
In turn, these qualifiers are type, dir and proto. So far so good, but further down we find this:
ip host host
which is equivalent to:
ether proto \ip and host host
In the first case, ip and host are, respectively, proto and type. What pattern does ether proto \ip follow? Isn't that, as a whole, a proto qualifier? If so, why isn't (a properly escaped) 'ether proto \ip host host' legal (no and)?