Howto use wildcards in netfmt filters

[Ralph Grothe]

Hello,

I am inept to perform the trivial task of telling netfmt to filter for *any* (high range) local port of a client connection to a service running where I do run the nettl trace.

All these variants result in bad filter errors by netfmt.

filter connection 123.123.123.123:* 231.231.231.231:4444

filter connection 123.123.123.123: 231.231.231.231:4444

filter connection 123.123.123.123 231.231.231.231:4444


If there was a way to tell netfmt to logically AND filters per layer (in the manpage it says filters within layers are ORed and accross layers are ANDed)

then I would do something like

filter ip_daddr 231.231.231.231 && tcp_dport 4444 && filter ip_saddr 123.123.123.123


but that doesn't work either.

Thanks
Ralph

[Ermin Borovac]

How about

filter ip_saddr 123.123.123.123
filter ip_daddr 231.231.231.231
filter tcp_dport 4444

[Ralph Grothe]

Hello Ermin,

your suggestion was of course my first filter.
But it didn't work as I expected,
and with it I was capturing every packet that at layer 3 that had the named IP source *or* destination address *and* at layer 4 the given destination port.

or to quote from netfmt manpage:

For a packet to make it through a filter layer which has a
filter specified, it must match the filter. Filters at each layer are
logically ``OR''ed. Filters between layers are logically ``AND''ed.


So the filter wasn't as restrictive as I would have wished, and I rather would want it to behave like what I am used to from tcpdump or snoop where you can intersperse logical operators between separate filters.

Well, as a last resort I still could install the libpcap together with tcpdump.

Besides, I started a new thread with a nettl netfmt question redarding accounting.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1014485

Regards
Ralph

[Ermin Borovac]

Hello Ralph,

Have you tried omitting ip_saddr filter? i.e just have

filter ip_daddr 231.231.231.231
filter tcp_dport 4444

It might be close to what you're after.