"expr": [
{ "match": {
"left": { "payload": {
- "name": "tcp",
+ "protocol": "tcp",
"field": "dport"
}},
"right": 22
[verse]
____
*{ "payload": {
- "name": "raw",
"base":* 'BASE'*,
"offset":* 'NUMBER'*,
"len":* 'NUMBER'
*}}*
*{ "payload": {
- "name":* 'STRING'*,
+ "protocol":* 'STRING'*,
"field":* 'STRING'
*}}*
*"th"*::
Offset is relative to Transport Layer header start offset.
-The second form allows to reference a field by name (*field*) in a named packet header (*name*).
+The second form allows to reference a field by name (*field*) in a named packet
+header (*protocol*).
=== EXTHDR
[verse]
json_t *payload_expr_json(const struct expr *expr, struct output_ctx *octx)
{
- const struct proto_hdr_template *tmpl;
- const struct proto_desc *desc;
json_t *root;
- desc = expr->payload.desc;
- tmpl = expr->payload.tmpl;
if (payload_is_known(expr))
root = json_pack("{s:s, s:s}",
- "name", desc->name,
- "field", tmpl->token);
+ "protocol", expr->payload.desc->name,
+ "field", expr->payload.tmpl->token);
else
- root = json_pack("{s:s, s:s, s:i, s:i}",
- "name", "raw",
+ root = json_pack("{s:s, s:i, s:i}",
"base", proto_base_tokens[expr->payload.base],
"offset", expr->payload.offset,
"len", expr->len);
static struct expr *json_parse_payload_expr(struct json_ctx *ctx,
const char *type, json_t *root)
{
- const char *name;
- const char *field;
- int val;
- const struct proto_desc *proto;
-
- if (json_unpack_err(ctx, root, "{s:s}", "name", &name))
- return NULL;
-
- /* special treatment for raw */
+ const char *protocol, *field, *base;
+ int offset, len, val;
- if (!strcmp(name, "raw")) {
- int offset, len, baseval;
+ if (!json_unpack(root, "{s:s, s:i, s:i}",
+ "base", &base, "offset", &offset, "len", &len)) {
struct expr *expr;
- const char *base;
- if (json_unpack_err(ctx, root, "{s:s, s:i, s:i}",
- "base", &base,
- "offset", &offset,
- "len", &len))
- return NULL;
if (!strcmp(base, "ll")) {
- baseval = PROTO_BASE_LL_HDR;
+ val = PROTO_BASE_LL_HDR;
} else if (!strcmp(base, "nh")) {
- baseval = PROTO_BASE_NETWORK_HDR;
+ val = PROTO_BASE_NETWORK_HDR;
} else if (!strcmp(base, "th")) {
- baseval = PROTO_BASE_TRANSPORT_HDR;
+ val = PROTO_BASE_TRANSPORT_HDR;
} else {
json_error(ctx, "Invalid payload base '%s'.", base);
return NULL;
}
expr = payload_expr_alloc(int_loc, NULL, 0);
- payload_init_raw(expr, baseval, offset, len);
+ payload_init_raw(expr, val, offset, len);
expr->byteorder = BYTEORDER_BIG_ENDIAN;
expr->payload.is_raw = true;
-
return expr;
- }
+ } else if (!json_unpack(root, "{s:s, s:s}",
+ "protocol", &protocol, "field", &field)) {
+ const struct proto_desc *proto = proto_lookup_byname(protocol);
- proto = proto_lookup_byname(name);
- if (!proto) {
- json_error(ctx, "Unknown payload expr name '%s'.", name);
- return NULL;
- }
- if (json_unpack_err(ctx, root, "{s:s}", "field", &field))
- return NULL;
- if (json_parse_payload_field(proto, field, &val)) {
- json_error(ctx, "Unknown %s field '%s'.", name, field);
- return NULL;
+ if (!proto) {
+ json_error(ctx, "Unknown payload protocol '%s'.",
+ protocol);
+ return NULL;
+ }
+ if (json_parse_payload_field(proto, field, &val)) {
+ json_error(ctx, "Unknown %s field '%s'.",
+ protocol, field);
+ return NULL;
+ }
+ return payload_expr_alloc(int_loc, proto, val);
}
- return payload_expr_alloc(int_loc, proto, val);
+ json_error(ctx, "Invalid payload expression properties.");
+ return NULL;
}
static struct expr *json_parse_tcp_option_expr(struct json_ctx *ctx,
"payload": {
"base": "th",
"len": 16,
- "name": "raw",
"offset": 16
}
},
"payload": {
"base": "th",
"len": 16,
- "offset": 16,
- "name": "raw"
+ "offset": 16
}
},
"right": {
"payload": {
"base": "nh",
"len": 8,
- "name": "raw",
"offset": 8
}
},
"payload": {
"base": "nh",
"len": 16,
- "name": "raw",
"offset": 8
}
},
"payload": {
"base": "ll",
"len": 1,
- "name": "raw",
"offset": 0
}
},
"payload": {
"base": "ll",
"len": 8,
- "name": "raw",
"offset": 0
}
},
"payload": {
"base": "ll",
"len": 128,
- "name": "raw",
"offset": 0
}
},
"payload": {
"base": "th",
"len": 16,
- "name": "raw",
"offset": 16
}
},
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"payload": {
"base": "ll",
"len": 8,
- "name": "raw",
"offset": 0
}
},
"payload": {
"base": "ll",
"len": 8,
- "name": "raw",
"offset": 0
}
},
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 1
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 22
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ptype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "0x0800"
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 22
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 22
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "request"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "reply"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "rrequest"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "rreply"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "inrequest"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "inreply"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "nak"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "reply"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ptype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "0x0800"
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 1
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 6
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 4
"payload": {
"base": "nh",
"len": 32,
- "name": "raw",
"offset": 192
}
},
"payload": {
"base": "nh",
"len": 48,
- "name": "raw",
"offset": 144
}
},
"left": {
"payload": {
"field": "ptype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "ip"
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": {
"left": {
"payload": {
"field": "operation",
- "name": "arp"
+ "protocol": "arp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "htype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 1
"left": {
"payload": {
"field": "ptype",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": "ip"
"left": {
"payload": {
"field": "hlen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 6
"left": {
"payload": {
"field": "plen",
- "name": "arp"
+ "protocol": "arp"
}
},
"right": 4
"payload": {
"base": "nh",
"len": 32,
- "name": "raw",
"offset": 192
}
},
"payload": {
"base": "nh",
"len": 48,
- "name": "raw",
"offset": 144
}
},
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "daddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:01:02:03:04:05"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ff:fe:dc:ba:98:76"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "icmp"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "icmpv6"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 1
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 58
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip6"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip6"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip6"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip6"
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip6"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 0
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "cfi",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 0
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "cfi",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "cfi",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "cfi",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "pcp",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 7
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "cfi",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "pcp",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 3
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 0
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "cfi",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 0
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "cfi",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 4094
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "10.0.0.1"
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": 1
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "id",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": {
"left": {
"payload": {
"field": "pcp",
- "name": "vlan"
+ "protocol": "vlan"
}
},
"right": {
"left": {
"payload": {
"field": "hdrlength",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "hdrlength",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hdrlength",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "hdrlength",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hdrlength",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "hdrlength",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": 22
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "reserved",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": 111
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "spi",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": 123
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "ah"
+ "protocol": "ah"
}
},
"op": "!=",
"left": {
"payload": {
"field": "nexthdr",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": "0x0"
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": 22
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "cpi",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "nexthdr",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": 0
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"right": {
"left": {
"payload": {
"field": "flags",
- "name": "comp"
+ "protocol": "comp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "type",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "type",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "type",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": "request"
"left": {
"payload": {
"field": "type",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "dccp"
+ "protocol": "dccp"
}
},
"right": {
"left": {
"payload": {
"field": "spi",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": 100
"left": {
"payload": {
"field": "spi",
- "name": "esp"
+ "protocol": "esp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "spi",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": {
"left": {
"payload": {
"field": "spi",
- "name": "esp"
+ "protocol": "esp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "spi",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": {
"left": {
"payload": {
"field": "spi",
- "name": "esp"
+ "protocol": "esp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "spi",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "esp"
+ "protocol": "esp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "esp"
+ "protocol": "esp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "esp"
+ "protocol": "esp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "esp"
+ "protocol": "esp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "icmp"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "icmpv6"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "ipv6-icmp"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": 1
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 1
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 58
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 58
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "destination-unreachable"
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
}
]
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "type",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "ip"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "hdrlength",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "hdrlength",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": 23
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": 23
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": 1111
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": 22
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"right": {
"left": {
"payload": {
"field": "vtag",
- "name": "sctp"
+ "protocol": "sctp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "@set1"
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 8080
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 1024
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 1024
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 0
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 0
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 1024
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 0
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 42949672
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "ackseq",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "flags",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": "cwr"
"left": {
"payload": {
"field": "flags",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flags",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "==",
{
"payload": {
"field": "flags",
- "name": "tcp"
+ "protocol": "tcp"
}
},
{
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22222
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "window",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 1234
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "urgptr",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "doff",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 8
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 1024
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 0
"left": {
"payload": {
"field": "sport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 0
{
"payload": {
"field": "flags",
- "name": "tcp"
+ "protocol": "tcp"
}
},
{
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 80
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 80
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 6666
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 6666
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 22
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 0
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 65535
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": 80
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "sport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": 80
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": 6666
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": 22
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "udplite"
+ "protocol": "udplite"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 81
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.2.3.4"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"val": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
}
}
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
"expr": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"mod": 2,
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-reply"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "destination-unreachable"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "source-quench"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "redirect"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "time-exceeded"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "parameter-problem"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "timestamp-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "timestamp-reply"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "info-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "info-reply"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "address-mask-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "address-mask-reply"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "router-advertisement"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "router-solicitation"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 111
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "code",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 12343
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 1245
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 22
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 22
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 33
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 22
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": 22
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "gateway",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "cs1"
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "0x38"
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 232
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 22
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 222
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "frag-off",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 0
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 233
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 255
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 13172
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 22
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.3.1"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.3.100"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "1.1.1.1"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.0.1"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.0.1"
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.0.2"
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"0xff"
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"0.0.0.255"
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"0xffff0000"
"left": {
"payload": {
"field": "version",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 4
"left": {
"payload": {
"field": "hdrlength",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 5
"left": {
"payload": {
"field": "hdrlength",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 0
"left": {
"payload": {
"field": "hdrlength",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 15
"left": {
"payload": {
"field": "hdrlength",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "127.0.0.1"
"left": {
"payload": {
"field": "checksum",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 0
"left": {
"payload": {
"field": "id",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 0
"left": {
"payload": {
"field": "ecn",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 1
"left": {
"payload": {
"field": "ecn",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "ce"
"left": {
"payload": {
"field": "ttl",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 23
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 1
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "af23"
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "cs0"
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "cs7"
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"0.0.0.255"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "ecn",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "ect1"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.1.3"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.1.3"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "192.168.1.3"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 1234
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "172.16.0.1"
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 9998
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 39128
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 9128
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 9128
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 9128
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 9128
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": 6
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "@set1"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "@set2"
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip"
+ "protocol": "ip"
}
}
]
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"op": "!=",
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": "ssh"
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": "ssh"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "protocol",
- "name": "ip"
+ "protocol": "ip"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 22
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1::2"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1::2"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1::2"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1::2"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 22
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1::2"
"left": {
"payload": {
"field": "saddr",
- "name": "ether"
+ "protocol": "ether"
}
},
"right": "00:0f:54:0c:11:04"
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
{
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
{
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "destination-unreachable"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "packet-too-big"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "time-exceeded"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "echo-reply"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "mld-listener-query"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "mld-listener-report"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "mld-listener-done"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "mld-listener-reduction"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-solicit"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-neighbor-solicit"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-neighbor-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-redirect"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "parameter-problem"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "router-renumbering"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "ind-neighbor-solicit"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "ind-neighbor-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "mld2-listener-report"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "code",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": 4
"left": {
"payload": {
"field": "code",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "code",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "code",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "code",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "code",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": 2222
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "checksum",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": 22
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "mtu",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "id",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "id",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": 2
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "sequence",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "mld-listener-done"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": {
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "cs1"
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "0x38"
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 22
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 22
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "length",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "esp"
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 1
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1234:1234:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234::1234:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234::1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:0:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234::1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:0:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234::1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234:1234:0:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234:1234:1234::"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1234:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234::1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234::1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234::1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234::1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234::1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234:1234::"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234::1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234::1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234::1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234::1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234::"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234::1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234::1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234::1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234::"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234::1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234::1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234::"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234::1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234::"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234::"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1"
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::2"
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::1"
"left": {
"payload": {
"field": "hoplimit",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 1
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "af42"
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 63
"left": {
"payload": {
"field": "ecn",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "ect0"
"left": {
"payload": {
"field": "ecn",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "ce"
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 0
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 12345
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "0xfffff"
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "cs7"
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "dscp",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 50
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "0:1234:1234:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:0:1234:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:0:1234:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:0:1234:1234:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234:0:1234:1234"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "1234:1234:1234:1234:1234:1234:1234:0"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "::18.52.18.52"
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
"left": {
"payload": {
"field": "flowlabel",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 1048575
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"::ffff"
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"::ffff"
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmpv6"
+ "protocol": "icmpv6"
}
},
"right": "nd-router-advert"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "type",
- "name": "icmp"
+ "protocol": "icmp"
}
},
"right": "echo-request"
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 954
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "fe00::cafe"
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 1234
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "fe00::cafe"
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 9998
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "tcp"
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 39128
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 9128
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": 9128
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 6
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "dport",
- "name": "udp"
+ "protocol": "udp"
}
},
"right": 53
"left": {
"payload": {
"field": "nexthdr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": 6
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": "@set2"
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"op": "!=",
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
}
]
{
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
{
"payload": {
"field": "daddr",
- "name": "ip6"
+ "protocol": "ip6"
}
}
]
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "dport",
- "name": "tcp"
+ "protocol": "tcp"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
"left": {
"payload": {
"field": "saddr",
- "name": "ip6"
+ "protocol": "ip6"
}
},
"right": {
projects / thirdparty / nftables.git / commitdiff
