In the Capturing packets recipe of this chapter, we showed a basic filter of char filter[] = "arp or tcp or udp or icmp";. In this recipe, we will take a more in-depth look at how to create a filter.

Since the libpcap library is used as the packet-capturing library for the tcpdump project, the libpcap filters take the same format as the tcpdump filter format. Any of the tcpdump filter expressions that we find on the Internet should work with libpcap. A Google search for "tcpdump filter" will return lots of results, but we will go over the basics in this recipe.