Chapter 12. Tools

 

A any

Packets to or from the IP address in field A matches. Field B is

 

ignored.

A to B

Packets from A to B matches.

B to A

Packets from B to A matches.

Between A&B

Packets from A to B, or from B to A, matches.

not this combination

Packets that do not match the given combination of A and B are

 

shown in the log.

If you, for example, want to study all packets to or from 10.3.27.18, except those to the file server 10.3.27.2, you should fill in the form like this:

Protocol/Port Selection

You can limit the selection by specifying certain protocols.

All IP protocols

No restriction regarding protocols.

TCP/UDP

When selecting TCP or UDP, you can choose all packets or packets to certain ports only.

In these fields, you can enter a single port number (32), a range of port numbers (1-1023), a list of port numbers and ranges separated by commas (53, 1024-65535) or nothing at all. If the field is empty, any port will match. See appendix G, Lists of ports, ICMP and protocols, for more information on port numbers.

If you want to study all traffic except the one to or from a specific port or group of ports, enter the port number(s) here and mark the "not this port" box.

The selection can be modified by the control boxes under the fields A and B:

A src

Packets from the port number in field A matches. Field B is

 

ignored.

A dst

Packets to the port number in field A matches. Field B is ignored.

A any

Packets to or from the port number in field A matches. Field B is

 

ignored.

A to B

Packets from A to B matches.

B to A

Packets from B to A matches.

Between A&B

Packets from A to B, or from B to A, matches.

218