The following program demonstrates how to set filters. Filters use the BPF format. If you have ever used Wireshark, you are probably already familiar with filters. There are many filter options that can be logically combined. Filters can be incredibly complex, and there are many cheat sheets online with common filters and examples of neat tricks. Here are a few examples to give you an idea of some very basic filters:
- host 192.168.0.123
- dst net 192.168.0.0/24
- port 22
- not broadcast and not multicast
Some of the preceding filters should be self-explanatory. The host filter will show only packets to or from that host. The dst net filter will capture incoming traffic that is going to a 192.168.0.* address. The port filter is watching only for port 22 traffic. The not broadcast and not multicast filter demonstrates how you can negate and combine multiple filters...