Filter syntax for g_tcpdump required when mixing "and" and "or"

[Martin_Hofbauer]

in tcpdump in bash following works as expected:

# tcpdump -i eth0 host A and host B and \(port C or port D\)

( round brackets ensure, that the "or" statement is only valid for the port numbers )

But I was not able to figure out howto do it with "g_tcpdump" to have the same results.

Any ideas ?

[Anatoly]

Hi,

It should be the same as tcpdump, just g_. If it doesn't work, try to do g_all tcpdump ….

Thanks

Anatoly

[HeikoAnkenbrand]

Hi @Anatoly 

in principle, the difference is clear to me. "g_all" executes the commands on all SGMs.

Is there a technical difference between "g_tcpdump" and "g_all tcpdump".

PS:
With  "g_tcpdump" filters I can also see that some things do not work 100% correct.

[Anatoly]

g_tcpdump and g_all tcpdump should be the same. However, since g_tcpdump has been developed as separate command, some differences may apply.

Please open support ticket if it's critical, if not - just use g_all tcpdump

[mrbhenry · Accepted solution]

I ran into this same issue and I see that this post was never really answered. sk173723 shows what to do:

Solution:
Escape any quotations or special characters in the g_tcpdump syntax with the backslash "\" character and use only single quotes, not double quotes.

Example:

Instead of this syntax:

g_tcpdump -nni eht1-Mgmt4 "host 1.1.1.1 and (port 22 or icmp)"

You must use this syntax:

g_tcpdump -nni eth1-Mgmt4 \'host 1.1.1.1 and \(port 22 or icmp\)\'

[Danny]

I created a one-liner that interactively creates the correct syntax for tcpdump or g_tcpdump depending on the Gaia system.