topic Re: Filter syntax for g_tcpdump required when mixing "and" and "or" in Hyperscale Firewall (Maestro)

Filter syntax for g_tcpdump required when mixing "and" and "or"

Martin_Hofbauer — Mon, 05 Oct 2020 14:50:41 GMT

in tcpdump in bash following works as expected:

# tcpdump -i eth0 host A and host B and \(port C or port D\)

( round brackets ensure, that the "or" statement is only valid for the port numbers )

But I was not able to figure out howto do it with "g_tcpdump" to have the same results.

Any ideas ?

Re: Filter syntax for g_tcpdump required when mixing "and" and "or"

Anatoly — Thu, 08 Oct 2020 05:51:09 GMT

Hi,

It should be the same as tcpdump, just g_. If it doesn't work, try to do g_all tcpdump ….

Thanks

Anatoly

Re: Filter syntax for g_tcpdump required when mixing "and" and "or"

HeikoAnkenbrand — Thu, 08 Oct 2020 06:20:46 GMT

Hi @Anatoly

in principle, the difference is clear to me. "g_all" executes the commands on all SGMs.

Is there a technical difference between "g_tcpdump" and "g_all tcpdump".

PS:
With "g_tcpdump" filters I can also see that some things do not work 100% correct.

Re: Filter syntax for g_tcpdump required when mixing "and" and "or"

Anatoly — Thu, 08 Oct 2020 06:23:42 GMT

g_tcpdump and g_all tcpdump should be the same. However, since g_tcpdump has been developed as separate command, some differences may apply.

Please open support ticket if it's critical, if not - just use g_all tcpdump

Re: Filter syntax for g_tcpdump required when mixing "and" and "or"

mrbhenry — Thu, 05 Feb 2026 22:35:06 GMT

I ran into this same issue and I see that this post was never really answered. sk173723 shows what to do:

Solution:
Escape any quotations or special characters in the g_tcpdump syntax with the backslash "\" character and use only single quotes, not double quotes.

Example:

Instead of this syntax:

g_tcpdump -nni eht1-Mgmt4 "host 1.1.1.1 and (port 22 or icmp)"

You must use this syntax:

g_tcpdump -nni eth1-Mgmt4 \'host 1.1.1.1 and \(port 22 or icmp\)\'

Re: Filter syntax for g_tcpdump required when mixing "and" and "or"

Danny — Mon, 09 Feb 2026 15:08:20 GMT

I created a one-liner that interactively creates the correct syntax for tcpdump or g_tcpdump depending on the Gaia system.