Which expression creates a filter on a host IP address or name?

The expression '[src|dst] host <host>' matches packets where the specified IP address or resolvable hostname appears as the source, the destination, or either endpoint, making it the correct primitive for host-based filtering. This is part of the BPF filter language used by tcpdump and Wireshark, where the optional src or dst qualifier restricts matching to one traffic direction. Without a qualifier, both directions are matched by default.

This expression filters by TCP or UDP port number using the port primitive, not by IP address or hostname.

The 'ether host' primitive filters on Layer 2 Ethernet MAC addresses, not on Layer 3 IP addresses or hostnames.

The 'gateway host' primitive matches packets that were routed through a specific intermediate host, which tests routing path rather than source or destination identity.