捕获过滤器
dhcp only udp port 68 and udp port 67
Protocol ether ip arp tcp udp rarp
direction src dst src and dst src or dst
host net port host portrange
logical operations not 具有最高优先级 or and 具有相同优先级 运算从左至右
not tcp port 3128 and tcp port 23 = （not tcp port3128 ) and tcp port23
not tcp port3218 and tcp port 23 不等于 not (tcp port3128 and tcp port 23)
tcp dst port 3128
ip src host 10.1.1.1
host 10.1.2.3
src portrange 2000-2500
no icmp
src host 10.7.2.12 and not dst net 10.200.0.0/16
(src host 10.4.1.12 or src net 10.6.0.0/16) and tcp dst portrange 200-10000 and dst net 10.0.0.0/8
ether proto \ip
ether proto \icmp
multicast broadcast
no broadcast no multicast
ether host 00:08:15:00:08:15
ether proto 0x0806
no arp
ip
tcp port http
port no 53
not port 80 and not port 25 and www.wireshark.org
