Display filters

Filters choose which packets l, the CLI list and -o / o saves show. They never change what is captured: every packet stays in memory, i can show any of them, and -O / O save them all.

The filters

Filter	Value	Matches
ipv4src / ipv4dest	an IPv4 address: 192.0.2.1	the source / destination address
ipv6src / ipv6dest	an IPv6 address: 2001:db8::1	the source / destination address
portsrc / portdest	a port, 1 to 65535	the TCP or UDP source / destination port
mesrc / medest	an interface name, or all	a source / destination that is one of your machine's addresses on that interface
proto	tcp, udp, icmp, icmpv6, gre... or 0 to 255	the protocol carried by IP
etype	arp, ipv4, ipv6, lldp, llc... or 0x88cc, or 1501 to 65535	the EtherType of the frame
macsrc / macdest	a MAC address: 00:00:5e:00:53:01 (or with -)	the Ethernet source / destination address
ifname	an interface name	the interface the packet was captured on
payloadmin / payloadmax	a size in bytes, 0 to 65535	a payload (everything after the IP header) of at least / at most that size
ttlmin / ttlmax	0 to 255	an IPv4 TTL / IPv6 hop limit of at least / at most that value
anomaly	a kind (scan, sweep, flood, burst, bruteforce, foreign, directip, refused, unanswered, synflood, nxdomain, dnsfail, unreachable, httperrors, beacon, spike, mismatch, dnstunnel, arpmoved, arpconflict, arpmulti, ptrburst) or all	the packets that are part of an anomaly of that kind, including those sent before it was detected. See Anomaly detection.

Shortcuts set the source and destination filters at once: ipv4 <ipv4>, ipv6 <ipv6>, port <port>, me <iface|all>, mac <mac>.

Details:

• IPv4 addresses are strictly dotted (192.0.2.1). IPv6 addresses take at most one ::, and no embedded IPv4 part.
• Ports start at 1: packets without ports (ICMP, ARP) have port 0, which no filter matches.
• ARP packets match the IPv4 filters: the sender address counts as the source, the target address as the destination.
• proto also looks past IPv6 extension headers: proto icmpv6 matches MLD packets behind a Hop-by-Hop header.
• etype llc matches every 802.3 frame (whose EtherType field is a length, 1500 or less).
• The interface named in me doesn't have to exist. M lists the addresses that me matches.
• The MAC filters never match packets captured without an Ethernet header (VPN and other tunnel interfaces). The TTL filters never match non-IP packets.
• A *min and a *max only make a range in AND mode, or inside an expression: 1 & 2.

Filters are toggles

Giving a filter that is already active removes it. A shortcut adds whichever of its two filters is missing, and removes both when both are active. To remove only one half, use r. p lists the active filters with their ids.

OR and AND

By default, a packet is shown when any active filter matches (OR). With -A, or after m, a packet must match every filter (AND).

AND treats a shortcut as two filters: port 53 in AND mode means source port 53 and destination port 53, which almost never happens. Use the single filters in AND mode:

# Only the DNS queries this machine sends
netotter -I capture.nto -c -A -F mesrc all, portdest 53,,

With no active filter, every packet is shown, in both modes.

Expressions

OR and AND apply to every filter at once. To mix them, or to leave packets out, combine the filters by their ids with an expression:

Symbol	Meaning
|	OR: either side matches
&	AND: both sides match
!	NOT: the filter or group after it doesn't match
( )	groups a part of the expression

! comes first, then &, then |: 1 | 2 & !3 means 1 | (2 & (!3)). Spaces don't matter.

The ids are the ones p shows, in the order the filters were added. A shortcut takes two ids: after ipv4 192.0.2.1, filter 1 is ipv4src 192.0.2.1 and filter 2 is ipv4dest 192.0.2.1.

Give an expression with e in interactive mode, or -E on the command line. While it's set, it replaces the OR / AND mode, and the active filters line shows it with the ids:

F ipv4dest 192.0.2.2, portdest 8080, portdest 443, proto udp,,
Active filters (OR): ipv4dest 192.0.2.2, portdest 8080, portdest 443, proto UDP
p
1 - ipv4dest 192.0.2.2
2 - portdest 8080
3 - portdest 443
4 - proto UDP
Combined with: OR
e 1 & (2 | 3) & !4
Active filters (1 & (2 | 3) & !4): 1 ipv4dest 192.0.2.2, 2 portdest 8080, 3 portdest 443, 4 proto UDP
l
#25    [veth0]     4.968173  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP     40 B  [SYN]
#27    [veth0]     4.968242  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP     32 B  [ACK]
#28    [veth0]     4.968326  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP    119 B  [PSH,ACK]  [GET]
#31    [veth0]     4.979909  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP     32 B  [ACK]
#33    [veth0]     4.980111  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP     32 B  [ACK]
#34    [veth0]     4.980203  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP     32 B  [FIN,ACK]
#36    [veth0]     4.980266  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP     32 B  [ACK]
7 of 54 packets shown (filters active)
Active filters (1 & (2 | 3) & !4): 1 ipv4dest 192.0.2.2, 2 portdest 8080, 3 portdest 443, 4 proto UDP

This keeps the packets sent to 192.0.2.2 on a web port, except the UDP ones: the HTTP/3 attempts to port 443 are left out. The same thing from the command line:

netotter -I learning.nto -c -F ipv4dest 192.0.2.2, portdest 8080, portdest 443, proto udp,, -E "1 & (2 | 3) & !4"

With -E, the ids count the filters of the -I file first, then those of -f / -F.

• e without an expression shows the filters with their ids, then asks for one. An empty line drops the expression, and the OR / AND mode applies again.
• A wrong expression is reported with its column, for example netotter: filter expression: no active filter has the id '5' at column 1. In interactive mode the current expression stays; with -E, NetOtter stops with exit code 1.
• f, F, r and c change the ids, so they drop the expression: Filter expression dropped (the filter ids changed). Give it again with e.
• m still switches between OR and AND, which apply once the expression is dropped.

Entering filters

Where	Syntax
Command line, one filter	-f port 53,
Command line, a list	-F port 53, ipv4 192.0.2.2,, (ended by two commas)
Command line, an expression	-E "1 & !2"
Interactive, one filter	f port 53
Interactive, a list	F port 53, proto udp,,, or F then lines of <filter> <value>, ended by a line starting with ,
Interactive, an expression	e 1 & !2

f, F, r and e ask for their argument when nothing follows the letter.

In interactive mode, a wrong filter is reported and skipped. On the command line, it stops NetOtter with exit code 1. Names are case-sensitive; protocol and EtherType names are not.

Example

F
Filters, end with a line starting with ',':
ipv4 192.0.2.2,
proto tcp,
,
Active filters (OR): ipv4src 192.0.2.2, ipv4dest 192.0.2.2, proto TCP
m
Filter mode: AND
Active filters (AND): ipv4src 192.0.2.2, ipv4dest 192.0.2.2, proto TCP
r
1 - ipv4src 192.0.2.2
2 - ipv4dest 192.0.2.2
3 - proto TCP
Filter id: 1
Active filters (AND): ipv4dest 192.0.2.2, proto TCP

Now l shows only the TCP packets sent to 192.0.2.2.

Filters in save files

The active filters and their mode are saved in .nto files and restored as active by -I. Filters given with -f / -F are then toggled on top of them, and -A overrides the saved mode.

Expressions aren't saved. o and -o still use the expression to choose which packets to save, so reloading the file shows the same packets, with the filters back in OR / AND. Give the expression again with -E if you need it.