FMADIO software support a custom syntax for filtering packets known as “frame filters”, consisting of one or more whitespace-separated clauses. These fulfill a similar role to (and are designed to resemble) Berkeley Packet Filters (BPF), although frame filters exist to be complimentary to BPF, providing functions that BPF can not. The following is a complete reference guide to writing these frame filters.
The general syntax for a frame filter clause is <key><operator><value>. Each section of this guide is one of the available keys.
The operator == defines equality; a frame will only pass the filter if the field given by <key> matches the given <value> (or one of the given values, if a list is given). != inverts an equality filter; a frame will only pass the filter if the field given by <key> does not match the given <value> (or, in the case of a list, does not match any of the given values).
Please note that:
whitespace between the three parts of the clause is not allowed.
if a clause supports passing a comma-separated list as a value, leading and trailing commas are forbidden. Whitespace between values and commas is also forbidden.
filter clauses have a logical OR relationship with each other, not logical AND. For example, if a packet was captured on a device with only two capture ports,
capture.port==0 capture.port==1will cause every single packet to be matched.
a7130.srcdevice
Available operators: ==, !=
When this filter clause is given, the filter system will assume that an Arista 7130 footer is present at the end of the packet, and filter based on its device ID field.
Note that this clause does not support a comma-separated list of IDs; there must only be one.
Each given device ID must be between 0 and 255 inclusively.
Examples:
a7130.srcdevice==0
a7130.srcdevice!=255a7130.srcport
Available operators: ==, !=
When this filter clause is given, the filter system will assume that an Arista 7130 timestamp footer is present at the end of the packet, and filter based on its port ID field.
Each given port ID must be between 0 and 255 inclusively.
Examples:
a7130.srcport==0
a7130.srcport==1,2
a7130.srcport!=64
a7130.srcport!=254,255c3550.srcport
Available operators: ==, !=
When this filter clause is given, the filter system will assume that a Cisco 3550 timestamp footer is present at the end of the packet, and filter based on its port ID field.
Each given port ID must be between 0 and 255 inclusively.
Examples:
c3550.srcport==0
c3550.srcport==1,2
c3550.srcport!=64
c3550.srcport!=254,255capture.port
Available operators: ==, !=
Frames only pass this filter if they came through one of the given capture ports on the FMADIO device.
Each given port ID must be between 0 and 7 inclusively.
Examples:
capture.port==0
capture.port==0,1
capture.port!=1
capture.port!=6,7