How to use fw monitor

Logical and Relational Operators
In addition to the single expressions testing for equality it is possible to combine different expressions
using several logical and relational operators
< Less than
> Greater than
= Greater than or equal to
= or is Equal
!= or is not Not equal
Figure 42: fw monitor – Relational Operators
, Logical AND
or Logical Or
xor Logical XOR
not Logcial NOT
Figure 43: fw monitor – Logical Operators
! Please note that INSPECT uses another operator precedence than e.g. C. In INSPECT the
expression “a , b or c” is understood as “a , ( b or c)”. That is, or takes precedence over
, (and). Parentheses “(“ and “)” – can be used to force operator precedence. There is no penalty
for redundant parentheses..
Using relational and logical operators it is easily possible to build complex capture filters:
Everything except http accept not ( [20:2,b]=80 or [22:2,b]=80);
Every non-root TCP connection accept [9:1]=9 , th_sport > 1024;
Every TCP packet between accept [9:1]=9 , (([12:4,b]=10.2.4.12 ,
10.2.4.12 and 172.16.1.2 [16:4,b]=172.16.1.2) or ([12:4,b]=172.16.1.2 ,
[16:4,b]=10.2.4.12));
Figure 44: fw monitor – example of logical and relational operators
! Even if fw monitor filters allow you to specify complex filters it’s normally not advisable. In many
cases a too complex filter might not capture packets you are interested in. It’s normally better to just
filter out bulk traffic you’re not interested in (e.g. HTTP) and do the granular filtering later on (e.g.
using Ethereal on files generated with -o). An exception is using fw monitor on high-loaded
gateways. There you might have simply no choice but to reduce the amiunt of traffic being captured.
How to use fw monitor Page 35 of 70
Revision: 1.01