执行man tcpdump，显示结果如下:
TCPDUMP(1) General Commands Manual TCPDUMP(1)
NAME
tcpdump - dump traffic on a network
SYNOPSIS
tcpdump [ -AbdDefhHIJKlLnNOpqStuUvxX# ] [ -B buffer_size ]
[ -c count ]
[ -C file_size ] [ -G rotate_seconds ] [ -F file ]
[ -i interface ] [ -j tstamp_type ] [ -m module ] [ -M secret ]
[ --number ] [ -Q in|out|inout ]
[ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ]
[ -E spi@ipaddr algo:secret,... ]
[ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
[ --time-stamp-precision=tstamp_precision ]
[ --immediate-mode ] [ --version ]
[ expression ]
其中各个选项的含义都好理解，最后的 expression该怎么理解呢?
观察 man tcpdump说明，expression的介绍见pcap-filter。
执行 man pcap-filter结果如下：
NAME
pcap-filter - packet filter syntax
DESCRIPTION
pcap_compile() is used to compile a string into a filter program. The resulting filter program can then be applied to some
stream of packets to determine which packets will be supplied to pcap_loop(), pcap_dispatch(), pcap_next(), or
pcap_next_ex().
The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by
one or more qualifiers. There are three different kinds of qualifier:
type type qualifiers say what kind of thing the id name or number refers to. Possible types are host, net , port and por‐
trange. E.g., `host foo', `net 128.3', `port 20', `portrange 6000-6008'. If there is no type qualifier, host is
assumed.
dir dir qualifiers specify a particular transfer direction to and/or from id. Possible directions are src, dst, src or
dst, src and dst, ra, ta, addr1, addr2, addr3, and addr4. E.g., `src foo', `dst net 128.3', `src or dst port ftp-
data'. If there is no dir qualifier, src or dst is assumed. The ra, ta, addr1, addr2, addr3, and addr4 qualifiers
are only valid for IEEE 802.11 Wireless LAN link layers. For some link layers, such as SLIP and the ``cooked'' Linux
capture mode used for the ``any'' device and for some other device types, the inbound and outbound qualifiers can be
used to specify a desired direction.
proto proto qualifiers restrict the match to a particular protocol. Possible protos are: ether, fddi, tr, wlan, ip, ip6,
arp, rarp, decnet, tcp and udp. E.g., `ether src foo', `arp net 128.3', `tcp port 21', `udp portrange 7000-7009',
`wlan addr2 0:2:3:4:5:6'. If there is no proto qualifier, all protocols consistent with the type are assumed. E.g.,
`src foo' means `(ip or arp or rarp) src foo' (except the latter is not legal syntax), `net bar' means `(ip or arp or
rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
综上可知expresssion中包含3类限定词，分别是类型，方向，以及协议。
类型：包含host，net， port， portrange
方向：包含src，dst ，src and dst ， src or dst ....
协议指：ether ip tcp udp ssh http ...
