tcpdump命令使用

执行man tcpdump，显示结果如下:
TCPDUMP(1) General Commands Manual TCPDUMP(1)

NAME
tcpdump - dump traffic on a network

SYNOPSIS
tcpdump [ -AbdDefhHIJKlLnNOpqStuUvxX# ] [ -B buffer_size ]
[ -c count ]
[ -C file_size ] [ -G rotate_seconds ] [ -F file ]
[ -i interface ] [ -j tstamp_type ] [ -m module ] [ -M secret ]
[ --number ] [ -Q in|out|inout ]
[ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ]
[ -E spi@ipaddr algo:secret,... ]
[ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
[ --time-stamp-precision=tstamp_precision ]
[ --immediate-mode ] [ --version ]
[ expression ]
其中各个选项的含义都好理解，最后的 expression该怎么理解呢?
观察 man tcpdump说明，expression的介绍见pcap-filter。
执行 man pcap-filter结果如下：
NAME
pcap-filter - packet filter syntax

DESCRIPTION
pcap_compile() is used to compile a string into a filter program. The resulting filter program can then be applied to some
stream of packets to determine which packets will be supplied to pcap_loop(), pcap_dispatch(), pcap_next(), or
pcap_next_ex().
The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by
one or more qualifiers. There are three different kinds of qualifier:

   type   type qualifiers say what kind of thing the id name or number refers to.  Possible types are host, net , port and  por‐
          trange.   E.g.,  `host  foo',  `net  128.3', `port 20', `portrange 6000-6008'.  If there is no type qualifier, host is
          assumed.

   dir    dir qualifiers specify a particular transfer direction to and/or from id.  Possible directions are src,  dst,  src  or
          dst,  src  and  dst,  ra, ta, addr1, addr2, addr3, and addr4.  E.g., `src foo', `dst net 128.3', `src or dst port ftp-
          data'.  If there is no dir qualifier, src or dst is assumed.  The ra, ta, addr1, addr2, addr3,  and  addr4  qualifiers
          are  only valid for IEEE 802.11 Wireless LAN link layers.  For some link layers, such as SLIP and the ``cooked'' Linux
          capture mode used for the ``any'' device and for some other device types, the inbound and outbound qualifiers  can  be
          used to specify a desired direction.

   proto  proto  qualifiers  restrict  the match to a particular protocol.  Possible protos are: ether, fddi, tr, wlan, ip, ip6,
          arp, rarp, decnet, tcp and udp.  E.g., `ether src foo', `arp net 128.3', `tcp port  21',  `udp  portrange  7000-7009',
          `wlan  addr2 0:2:3:4:5:6'.  If there is no proto qualifier, all protocols consistent with the type are assumed.  E.g.,
          `src foo' means `(ip or arp or rarp) src foo' (except the latter is not legal syntax), `net bar' means `(ip or arp  or
          rarp) net bar' and `port 53' means `(tcp or udp) port 53'.

综上可知expresssion中包含3类限定词，分别是类型，方向，以及协议。

类型：包含host，net， port， portrange
方向：包含src，dst ，src and dst ， src or dst ....
协议指：ether ip tcp udp ssh http ...