statement-1; statement-2; ... statement-n
Each of these statements is evaluated for each network traffic
found. The result used by the filter is the result of the
which must be a boolean. If the result is
then the datapoint is passed by the filter, and added to
the chart. If the result is
then that datapoint is discarded. If the final expression
is not a boolean, then an error is indicated. Note that the
statements prior to the final one may have side effects,
that affect the result of the final statement.
A common requirement, but one difficult to formulate in a filter,
is testing if an IP address is a member of a specific subnet. To
make this easier, a function is provided for this purpose:
inSubnet(address, subnet, maskBits).
This will return
is a member of
subnet with a mask of length
address can be any address
field, or in fact any string representing an IP address.
For example, to create a filter to retain only traffic from subnet 10.1.2.0/24, use this filter:
inSubnet(ipSource, "10.1.2.0", 24)
More complex filters can be constructed; for example, if you wanted all traffic from the above subnet going to another subnet 192.168.0.0/16, then you could use:
inSubnet(ipSource, "10.1.2.0", 24) && inSubnet(ipDestination, "192.168.0.0", 16)