How to do it...

To configure structured filters, you simply write the conditions according to what we learned in the previous recipes, with conditions to meet your requirements.

Some common filters are:

  • For capturing only unicast packets, configure not broadcast and not multicast
  • For capturing HTTP packets to www.youtube.com, configure host www.youtube.com and port 80
  • For a capture filter for telnet that captures traffic to and from a particular host, configure tcp port 23 and host 192.180.1.1
  • For capturing all telnet traffic not from 192.168.1.1, configure tcp port 23 and not src host 192.168.1.1
  • To capture packets to port 80 (HTTP) on servers 216.58.209.68 and 216.58.209.69, configure ((tcp) and (port 80) and ((dst host 216.58.209.68) or (dst host 216.58.209.69)))