Operator indicating the type of comparison.
==== OPERATORS
-The operator is usually optional and if omitted usually defaults to "==".
-Allowed operators are:
[horizontal]
*&*:: Binary AND
*>*:: Greater than
*<=*:: Less than or equal to
*>=*:: Greater than or equal to
+*in*:: Perform a lookup, i.e. test if bits on RHS are contained in LHS value
+
+Unlike with standard API, the operator is mandatory here. In standard API,
+missing operator may be resolved in two ways depending on the type of expression
+on RHS:
+
+- If RHS is a bitmask or a list of bitmasks, the expression resolves into a
+ binary operation with not equal operator, like this: '+LHS & RHS != 0+'.
+- In any other case, equal operator is simply inserted.
+
+For the non-trivial first case, JSON API supports *in* operator.
=== COUNTER
[verse]
json_t *relational_expr_json(const struct expr *expr, struct output_ctx *octx)
{
- json_t *tmp;
-
- tmp = json_pack("{s:o, s:o}",
- "left", expr_print_json(expr->left, octx),
- "right", expr_print_json(expr->right, octx));
- /* XXX: check taken from binop_expr_print()
- * if right is range, op is OP_EQ which in turn crashes nft if fed with it */
- if (expr_op_symbols[expr->op] &&
- (expr->op != OP_EQ || must_print_eq_op(expr)))
- json_object_set_new(tmp, "op",
- json_string(expr_op_symbols[expr->op]));
-
- return json_pack("{s:o}", "match", tmp);
+ return json_pack("{s:{s:s, s:o, s:o}}", "match",
+ "op", expr_op_symbols[expr->op] ? : "in",
+ "left", expr_print_json(expr->left, octx),
+ "right", expr_print_json(expr->right, octx));
}
json_t *range_expr_json(const struct expr *expr, struct output_ctx *octx)
const char *opstr = NULL;
enum ops op;
- if (json_unpack_err(ctx, value, "{s:o, s:o}",
+ if (json_unpack_err(ctx, value, "{s:o, s:o, s:s}",
"left", &jleft,
- "right", &jright))
+ "right", &jright,
+ "op", &opstr))
return NULL;
- json_unpack(value, "{s:s}", "op", &opstr);
- if (opstr) {
- for (op = OP_INVALID; op < __OP_MAX; op++) {
- if (expr_op_symbols[op] &&
- !strcmp(opstr, expr_op_symbols[op]))
- break;
- }
- if (op == __OP_MAX) {
+ for (op = OP_INVALID; op < __OP_MAX; op++) {
+ if (expr_op_symbols[op] &&
+ !strcmp(opstr, expr_op_symbols[op]))
+ break;
+ }
+ if (op == __OP_MAX) {
+ if (!strcmp(opstr, "in")) {
+ op = OP_IMPLICIT;
+ } else {
json_error(ctx, "Unknown relational op '%s'.", opstr);
return NULL;
}
- } else {
- op = OP_IMPLICIT;
}
left = json_parse_expr(ctx, jleft);
"key": "state"
}
},
+ "op": "in",
"right": [
"new",
"established",
"key": "state"
}
},
+ "op": "in",
"right": {
"set": [
"new",
"key": "state"
}
},
+ "op": "in",
"right": "invalid"
}
},
"key": "state"
}
},
+ "op": "in",
"right": "established"
}
},
"key": "state"
}
},
+ "op": "in",
"right": 8
}
}
"key": "direction"
}
},
+ "op": "==",
"right": "original"
}
}
"key": "direction"
}
},
+ "op": "==",
"right": "reply"
}
}
"key": "direction"
}
},
+ "op": "in",
"right": {
"set": [
"reply",
"key": "status"
}
},
+ "op": "in",
"right": "expected"
}
}
"key": "status"
}
},
+ "op": "in",
"right": "seen-reply"
}
}
"key": "status"
}
},
+ "op": "==",
"right": {
"set": [
"expected",
"key": "status"
}
},
+ "op": "in",
"right": [
"expected",
"seen-reply",
"key": "status"
}
},
+ "op": "in",
"right": "snat"
}
}
"key": "status"
}
},
+ "op": "in",
"right": "dnat"
}
}
"key": "mark"
}
},
+ "op": "==",
"right": 0
}
}
"0x23"
]
},
+ "op": "==",
"right": "0x11"
}
}
"key": "mark"
}
},
+ "op": "==",
"right": "0x00000032"
}
}
"key": "mark"
}
},
+ "op": "==",
"right": {
"range": [ "0x00000032", "0x00000045" ]
}
"key": "mark"
}
},
+ "op": "in",
"right": {
"set": [
"0x32",
"key": "mark"
}
},
+ "op": "in",
"right": {
"set": [
{
"key": "expiration"
}
},
+ "op": "==",
"right": "30s"
}
}
"key": "expiration"
}
},
+ "op": "==",
"right": "30000ms"
}
}
"key": "expiration"
}
},
+ "op": "==",
"right": {
"range": [ "1m", "1h" ]
}
"key": "expiration"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"key": "expiration"
}
},
+ "op": "==",
"right": {
"set": [
33,
"key": "expiration"
}
},
+ "op": "==",
"right": {
"set": [
{
"key": "helper"
}
},
+ "op": "==",
"right": "ftp"
}
}
}
]
},
+ "op": "==",
"right": {
"set": [
{
}
]
},
+ "op": "==",
"right": {
"set": [
{ "concat": [ "new", "0x12345678" ] },
}
]
},
+ "op": "==",
"right": {
"set": [
{
"key": "label"
}
},
+ "op": "in",
"right": 127
}
}
"key": "zone"
}
},
+ "op": "==",
"right": 0
}
}
"key": "zone"
}
},
+ "op": "==",
"right": 23
}
}
"key": "zone"
}
},
+ "op": "==",
"right": 1
}
}
"key": "zone"
}
},
+ "op": "==",
"right": 1
}
}
"key": "state"
}
},
+ "op": "in",
"right": [
"established",
"related",
"key": "state"
}
},
+ "op": "==",
"right": {
"set": [
"established",
"key": "state"
}
},
+ "op": "in",
"right": "new"
}
}
"key": "direction"
}
},
+ "op": "==",
"right": {
"set": [
"original",
"key": "mark"
}
},
+ "op": "==",
"right": 50
}
}
"key": "mark"
}
},
+ "op": "==",
"right": 50
}
}
"key": "mark"
}
},
+ "op": "==",
"right": {
"range": [ 50, 69 ]
}
"key": "mark"
}
},
+ "op": "==",
"right": {
"set": [
50,
"key": "mark"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 50, 8738 ] },
"key": "expiration"
}
},
+ "op": "==",
"right": 30
}
}
"key": "expiration"
}
},
+ "op": "==",
"right": 30
}
}
"key": "expiration"
}
},
+ "op": "==",
"right": {
"range": [ 60, 3600 ]
}
}
]
},
+ "op": "==",
"right": {
"set": [
{
}
]
},
+ "op": "==",
"right": {
"set": [
{
}
]
},
+ "op": "==",
"right": {
"set": [
{
"left": {
"meta": { "key": "length" }
},
+ "op": "==",
"right": 1000
}
}
"left": {
"meta": { "key": "length" }
},
+ "op": "==",
"right": 22
}
}
"left": {
"meta": { "key": "length" }
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"left": {
"meta": { "key": "length" }
},
+ "op": "==",
"right": {
"set": [
33,
"left": {
"meta": { "key": "length" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] },
"left": {
"meta": { "key": "length" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 88 ] },
"left": {
"meta": { "key": "length" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"left": {
"meta": { "key": "protocol" }
},
+ "op": "==",
"right": {
"set": [
"ip",
"left": {
"meta": { "key": "protocol" }
},
+ "op": "==",
"right": "ip"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 22
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": {
"set": [
33,
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "root"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "none"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "0x87654321"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": 2271560481
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "1:1234"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "bcad:dadc"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "aabb:0"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": {
"range": [ "bcad:dada", "bcad:dadc" ]
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": {
"set": [
"bcad:dada",
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": "0x4"
}
}
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": "0x32"
}
}
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": "0x10"
}
}
"0x03"
]
},
+ "op": "==",
"right": "0x01"
}
}
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "dummy0"
}
}
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": {
"set": [
"dummy0",
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "dummy*"
}
}
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "dummy\\*"
}
}
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": {
"set": [
"ether",
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": "ether"
}
}
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": "ppp"
}
}
"left": {
"meta": { "key": "oif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "oif" }
},
+ "op": "==",
"right": {
"set": [
"lo"
"left": {
"meta": { "key": "oifname" }
},
+ "op": "==",
"right": "dummy0"
}
}
"left": {
"meta": { "key": "oifname" }
},
+ "op": "==",
"right": {
"set": [
"dummy0",
"left": {
"meta": { "key": "oifname" }
},
+ "op": "==",
"right": "dummy*"
}
}
"left": {
"meta": { "key": "oifname" }
},
+ "op": "==",
"right": "dummy\\*"
}
}
"left": {
"meta": { "key": "oiftype" }
},
+ "op": "==",
"right": {
"set": [
"ether",
"left": {
"meta": { "key": "oiftype" }
},
+ "op": "==",
"right": "ether"
}
}
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": {
"set": [
"bin",
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": "root"
}
}
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": 3000
}
},
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": {
"range": [ 3001, 3005 ]
}
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 2001, 2005 ] }
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": {
"set": [
"bin",
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": "root"
}
}
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": 3000
}
},
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": {
"range": [ 2001, 2005 ]
}
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 2001, 2005 ] }
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
}
"left": {
"meta": { "key": "oif" }
},
+ "op": "==",
"right": "lo"
}
}
"left": {
"meta": { "key": "oifname" }
},
+ "op": "==",
"right": "dummy2"
}
},
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": 3000
}
}
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": 3000
}
}
"left": {
"meta": { "key": "rtclassid" }
},
+ "op": "==",
"right": "cosmos"
}
}
"left": {
"meta": { "key": "pkttype" }
},
+ "op": "==",
"right": "broadcast"
}
}
"left": {
"meta": { "key": "pkttype" }
},
+ "op": "==",
"right": "host"
}
}
"left": {
"meta": { "key": "pkttype" }
},
+ "op": "==",
"right": "multicast"
}
}
"left": {
"meta": { "key": "pkttype" }
},
+ "op": "==",
"right": {
"set": [
"broadcast",
"left": {
"meta": { "key": "cpu" }
},
+ "op": "==",
"right": 1
}
}
"left": {
"meta": { "key": "cpu" }
},
+ "op": "==",
"right": {
"range": [ 1, 3 ]
}
"left": {
"meta": { "key": "cpu" }
},
+ "op": "==",
"right": {
"set": [
2,
"left": {
"meta": { "key": "cpu" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 2, 3 ] },
"left": {
"meta": { "key": "iifgroup" }
},
+ "op": "==",
"right": 0
}
}
"left": {
"meta": { "key": "iifgroup" }
},
+ "op": "==",
"right": "default"
}
}
"left": {
"meta": { "key": "iifgroup" }
},
+ "op": "==",
"right": {
"set": [
"default"
"left": {
"meta": { "key": "iifgroup" }
},
+ "op": "==",
"right": {
"set": [
11,
"left": {
"meta": { "key": "iifgroup" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 11, 33 ] }
"left": {
"meta": { "key": "oifgroup" }
},
+ "op": "==",
"right": 0
}
}
"left": {
"meta": { "key": "oifgroup" }
},
+ "op": "==",
"right": "default"
}
}
"left": {
"meta": { "key": "oifgroup" }
},
+ "op": "==",
"right": {
"set": [
"default"
"left": {
"meta": { "key": "oifgroup" }
},
+ "op": "==",
"right": {
"set": [
11,
"left": {
"meta": { "key": "oifgroup" }
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 11, 33 ] }
"left": {
"meta": { "key": "cgroup" }
},
+ "op": "==",
"right": 1048577
}
}
"left": {
"meta": { "key": "cgroup" }
},
+ "op": "==",
"right": {
"set": [
1048577,
"left": {
"meta": { "key": "cgroup" }
},
+ "op": "==",
"right": {
"range": [ 1048577, 1048578 ]
}
"left": {
"meta": { "key": "cgroup" }
},
+ "op": "==",
"right": {
"set": [
{
}
]
},
+ "op": "==",
"right": {
"set": [
{
}
]
},
+ "op": "==",
"right": {
"set": [
{
"left": {
"meta": { "key": "random" }
},
+ "op": "==",
"right": 1
}
}
"left": {
"meta": { "key": "protocol" }
},
+ "op": "==",
"right": {
"set": [
"ip",
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "8765:4321"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": "8765:4321"
}
}
"left": {
"meta": { "key": "priority" }
},
+ "op": "==",
"right": {
"set": [
"aaaa:bbbb",
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 4
}
}
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 50
}
}
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 16
}
}
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 2
}
}
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": {
"set": [
"lo",
"left": {
"meta": { "key": "oifname" }
},
+ "op": "==",
"right": {
"set": [
"lo",
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": {
"set": [ 0, 1, 2 ]
}
"left": {
"meta": { "key": "skuid" }
},
+ "op": "==",
"right": 0
}
}
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": {
"set": [ 0, 1, 2 ]
}
"left": {
"meta": { "key": "skgid" }
},
+ "op": "==",
"right": 0
}
}
"left": {
"meta": { "key": "iifgroup" }
},
+ "op": "==",
"right": "default"
}
}
"left": {
"meta": { "key": "oifgroup" }
},
+ "op": "==",
"right": "default"
}
}
}
]
},
+ "op": "==",
"right": {
"set": [
{
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": {
"set": [
"tcp",
"offset": 16
}
},
+ "op": "==",
"right": {
"set": [
22,
{
"match": {
"left": { "meta": { "key": "l4proto" } },
+ "op": "==",
"right": "tcp"
}
},
"offset": 16
}
},
+ "op": "==",
"right": {
"set": [
22,
"offset": 8
}
},
+ "op": "==",
"right": 255
}
}
"offset": 8
}
},
+ "op": "==",
"right": 0
}
}
"offset": 0
}
},
+ "op": "==",
"right": 1
}
}
"offset": 0
}
},
+ "op": "==",
"right": "0xfedcba987654321001234567890abcde"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": {
"set": [
6,
"offset": 16
}
},
+ "op": "==",
"right": {
"set": [
22,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
22,
"key": "classid"
}
},
+ "op": "==",
"right": "cosmos"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "arp"
}
},
+ "op": "==",
"right": "0x0800"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "arp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
"nak",
"protocol": "arp"
}
},
+ "op": "==",
"right": "request"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": "reply"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": "rrequest"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": "rreply"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": "inrequest"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": "inreply"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": "nak"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": "reply"
}
}
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "invalid"
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": "0x0800"
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": 4
}
},
"offset": 192
}
},
+ "op": "==",
"right": "0xc0a88f10"
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": "ip"
}
}
"protocol": "arp"
}
},
+ "op": "==",
"right": {
"set": [
"request",
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "invalid"
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "arp"
}
},
+ "op": "==",
"right": 4
}
},
"offset": 192
}
},
+ "op": "==",
"right": 3232272144
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": "ether"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:01:02:03:04:05"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "icmp"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "icmpv6"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": 58
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"left": {
"meta": { "key": "obrname" }
},
+ "op": "==",
"right": "br0"
}
}
"left": {
"meta": { "key": "ibrname" }
},
+ "op": "==",
"right": "br0"
}
}
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 12345
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip6"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip6"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip6"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip6"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip6"
}
},
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 12345
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 7
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 3
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 4094
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "10.0.0.1"
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "10.0.0.0",
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "10.0.0.0",
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "10.0.0.0",
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
}
"protocol": "vlan"
}
},
+ "op": "==",
"right": {
"set": [
1,
"protocol": "vlan"
}
},
+ "op": "==",
"right": {
"range": [ 1, 3 ]
}
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"range": [ 11, 23 ]
}
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 11, 23 ] }
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
11,
"protocol": "ah"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
23,
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ah"
}
},
+ "op": "==",
"right": 111
}
}
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"range": [ 111, 222 ]
}
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
111,
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 111, 122 ] }
"protocol": "ah"
}
},
+ "op": "==",
"right": 123
}
}
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
23,
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 23, 33 ] }
"protocol": "ah"
}
},
+ "op": "==",
"right": {
"range": [ 23, 33 ]
}
"protocol": "comp"
}
},
+ "op": "==",
"right": "0x0"
}
}
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"range": [ "0x33", "0x45" ]
}
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"set": [
"0x33",
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ "0x33", "0x55" ] }
"protocol": "comp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "comp"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"range": [ 51, 69 ]
}
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"set": [
51,
"protocol": "comp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 51, 85 ] }
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"key": "saddr"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"key": "saddr"
}
},
+ "op": "==",
"right": "::1"
}
}
"key": "saddr"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"range": [ 21, 35 ]
}
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"set": [
23,
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 20, 50 ] }
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"range": [ "ftp-data", "re-mail-ck" ]
}
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"range": [ 20, 50 ]
}
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 20, 50 ] }
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"set": [
23,
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 20, 50 ] }
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"set": [
"request",
"protocol": "dccp"
}
},
+ "op": "==",
"right": "request"
}
}
"protocol": "dccp"
}
},
+ "op": "==",
"right": {
"range": [ 20, 50 ]
}
"protocol": "esp"
}
},
+ "op": "==",
"right": 100
}
}
"protocol": "esp"
}
},
+ "op": "==",
"right": {
"range": [ 111, 222 ]
}
"protocol": "esp"
}
},
+ "op": "==",
"right": {
"set": [
100,
"protocol": "esp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 100, 102 ] }
"protocol": "esp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "esp"
}
},
+ "op": "==",
"right": {
"range": [ 22, 24 ]
}
"protocol": "esp"
}
},
+ "op": "==",
"right": {
"set": [
22,
"protocol": "esp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 22, 25 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": "ether"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": "ether"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"result": "oifname"
}
},
+ "op": "==",
"right": "lo"
}
}
"result": "type"
}
},
+ "op": "==",
"right": "local"
}
}
"result": "oif"
}
},
+ "op": "==",
"right": true
}
}
"result": "oif"
}
},
+ "op": "==",
"right": false
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
{
"match": {
"left": { "meta": { "key": "nfproto" } },
+ "op": "==",
"right": "ipv4"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
{
"match": {
"left": { "meta": { "key": "nfproto" } },
+ "op": "==",
"right": "ipv4"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
{
"match": {
"left": { "meta": { "key": "nfproto" } },
+ "op": "==",
"right": "ipv6"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
{
"match": {
"left": { "meta": { "key": "nfproto" } },
+ "op": "==",
"right": "ipv6"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "icmp"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "icmpv6"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "ipv6-icmp"
}
},
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": "ipv6-icmp"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 1
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": 58
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 58
}
},
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 58
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "destination-unreachable"
}
}
}
]
},
+ "op": "==",
"right": {
"set": [
{
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ether"
}
},
+ "op": "==",
"right": "ip"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": {
"set": [
"ipv4",
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": "tcp"
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"left": {
"meta": { "key": "secpath" }
},
+ "op": "==",
"right": true
}
}
"left": {
"meta": { "key": "secpath" }
},
+ "op": "==",
"right": false
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 6
}
}
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 12345
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv6"
}
},
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 6
}
},
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 12345
}
},
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"key": "nexthop"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"key": "nexthop"
}
},
+ "op": "==",
"right": "fd00::1"
}
}
"left": {
"meta": { "key": "nfproto" }
},
+ "op": "==",
"right": "ipv4"
}
},
"key": "nexthop"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": 23
}
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"range": [ 23, 44 ]
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
23,
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 23, 44 ] }
"protocol": "sctp"
}
},
+ "op": "==",
"right": 23
}
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"range": [ 23, 44 ]
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
23,
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 23, 44 ] }
"protocol": "sctp"
}
},
+ "op": "==",
"right": 1111
}
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"range": [ 21, 333 ]
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
22,
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 22, 44 ] }
"protocol": "sctp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "sctp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ip"
}
},
+ "op": "==",
"right": "@set1"
}
},
"key": "transparent"
}
},
+ "op": "==",
"right": 0
}
}
"key": "transparent"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
"telnet",
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
22,
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": 8080
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 1024
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 1024
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 0
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 1024
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 0
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
1024,
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": 42949672
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
"fin",
"protocol": "tcp"
}
},
+ "op": "in",
"right": "cwr"
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22222
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": 1234
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "tcp"
}
},
+ "op": "==",
"right": 8
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
23,
"protocol": "tcp"
}
},
+ "op": "==",
"right": 1024
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
1022,
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 0
}
}
"name": "eol"
}
},
+ "op": "==",
"right": 1
}
}
"name": "noop"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack-permitted"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack-permitted"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack0"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack1"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack2"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack3"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack0"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack1"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack2"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack3"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": true
}
}
"name": "window"
}
},
+ "op": "==",
"right": false
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "udp"
}
},
+ "op": "==",
"right": 80
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"range": [ 50, 70 ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
49,
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 12, 40 ] }
"protocol": "udp"
}
},
+ "op": "==",
"right": 80
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"range": [ 70, 75 ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
49,
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 70, 75 ] }
"protocol": "udp"
}
},
+ "op": "==",
"right": 6666
}
}
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"range": [ 50, 65 ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
50,
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 35, 50 ] }
"protocol": "udp"
}
},
+ "op": "==",
"right": 6666
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "udp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"protocol": "udplite"
}
},
+ "op": "==",
"right": 80
}
},
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"range": [ 50, 70 ]
}
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"set": [
49,
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 12, 40 ] }
"protocol": "udplite"
}
},
+ "op": "==",
"right": 80
}
},
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"range": [ 70, 75 ]
}
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"set": [
49,
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 70, 75 ] }
"protocol": "udplite"
}
},
+ "op": "==",
"right": 6666
}
},
"protocol": "udplite"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "udplite"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"key": "saddr"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"key": "saddr"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"key": "daddr"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"key": "daddr"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"key": "saddr"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "192.168.1.0",
"key": "saddr"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "192.168.1.0",
"key": "daddr"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "192.168.1.0",
"key": "daddr"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "192.168.1.0",
"key": "l3proto"
}
},
+ "op": "==",
"right": "ipv4"
}
}
"key": "protocol"
}
},
+ "op": "==",
"right": 6
}
},
"key": "proto-dst"
}
},
+ "op": "==",
"right": 22
}
}
"key": "protocol"
}
},
+ "op": "==",
"right": 17
}
},
"key": "proto-src"
}
},
+ "op": "==",
"right": 53
}
}
"key": "protocol"
}
},
+ "op": "==",
"right": 17
}
},
"key": "proto-src"
}
},
+ "op": "==",
"right": 53
}
}
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 80, 90 ]
}
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
23,
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 81
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": "ether"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
}
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.2.3.4"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-reply"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "destination-unreachable"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "source-quench"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "redirect"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "time-exceeded"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "parameter-problem"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "timestamp-request"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "timestamp-reply"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "info-request"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "info-reply"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "address-mask-request"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "address-mask-reply"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "router-advertisement"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "router-solicitation"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
"echo-reply",
"protocol": "icmp"
}
},
+ "op": "==",
"right": 111
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 55 ]
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
2,
"protocol": "icmp"
}
},
+ "op": "==",
"right": 12343
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"range": [ 11, 343 ]
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 11, 343 ] }
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
1111,
"protocol": "icmp"
}
},
+ "op": "==",
"right": 1245
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
22,
"protocol": "icmp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmp"
}
},
+ "op": "==",
"right": 33
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"range": [ 22, 33 ]
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 22, 33 ] }
"protocol": "icmp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
"echo-reply",
"protocol": "icmp"
}
},
+ "op": "==",
"right": {
"set": [
222,
"protocol": "ip"
}
},
+ "op": "==",
"right": "cs1"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "0x38"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
"cs0",
"protocol": "ip"
}
},
+ "op": "==",
"right": 232
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ 333, 435 ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
333,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 333, 535 ] }
"protocol": "ip"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ip"
}
},
+ "op": "==",
"right": 222
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ip"
}
},
+ "op": "==",
"right": 0
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": 233
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ 33, 55 ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
43,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
"icmp",
"protocol": "ip"
}
},
+ "op": "==",
"right": 255
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 13172
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "192.168.2.0",
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.3.1"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.3.100"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "1.1.1.1"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "192.168.0.1", "192.168.0.250" ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "10.0.0.0", "10.255.255.255" ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "172.16.0.0", "172.31.255.255" ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "192.168.3.1", "192.168.4.250" ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ "192.168.0.1", "192.168.0.250" ] }
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
"192.168.5.1",
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "192.168.1.2", "192.168.1.55" ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "192.168.1.3", "192.168.33.55" ]
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.0.2"
}
}
"0xffff0000"
]
},
+ "op": "==",
"right": "0xffff0000"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 4
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": 5
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 15
}
}
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "cs7"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
"cs0",
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
1,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "255.255.0.0",
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
1,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "10.0.0.0", "10.2.3.4" ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"key": "state"
}
},
+ "op": "in",
"right": [
"established",
"new"
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": "icmp"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": "ipv6-icmp"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 58
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.1.3"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.1.3"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "192.168.1.3"
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 1234
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "172.16.0.1"
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 9998
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 39128
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 9128
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 9128
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 9128
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 9128
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
1,
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"range": [ "10.0.0.0", "10.2.3.4" ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"key": "state"
}
},
+ "op": "in",
"right": [
"established",
"new"
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": 6
}
},
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": "0x80000000"
}
},
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 2147483648
}
},
"key": "nexthop"
}
},
+ "op": "==",
"right": "192.168.0.1"
}
}
"protocol": "ip"
}
},
+ "op": "==",
"right": "@set1"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "@set2"
}
},
}
]
},
+ "op": "==",
"right": "@set5"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
"1.1.1.0",
"protocol": "ip"
}
},
+ "op": "==",
"right": {
"set": [
{
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 80, 90 ]
}
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
80,
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
23,
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"protocol": "ip"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": "ssh"
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": "ssh"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 22
}
},
"name": "eol"
}
},
+ "op": "==",
"right": 1
}
}
"name": "noop"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack-permitted"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack-permitted"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack1"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack2"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack3"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack0"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack1"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack2"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack3"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 80, 90 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 80, 90 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 80, 90 ]
}
"name": "dst"
}
},
+ "op": "==",
"right": 22
}
}
"name": "dst"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "dst"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "dst"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "dst"
}
},
+ "op": "==",
"right": {
"set": [
"udplite",
"name": "dst"
}
},
+ "op": "==",
"right": "icmp"
}
}
"name": "dst"
}
},
+ "op": "==",
"right": 22
}
}
"name": "dst"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "dst"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "dst"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "dst"
}
},
+ "op": "==",
"right": {
"set": [
6,
"name": "dst"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"left": {
"meta": { "key": "iiftype" }
},
+ "op": "==",
"right": "ether"
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1::2"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1::2"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1::2"
}
}
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1::2"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 22
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1::2"
}
},
"protocol": "ether"
}
},
+ "op": "==",
"right": "00:0f:54:0c:11:04"
}
},
"name": "hbh"
}
},
+ "op": "==",
"right": true
}
}
"name": "rt"
}
},
+ "op": "==",
"right": true
}
}
"name": "frag"
}
},
+ "op": "==",
"right": true
}
}
"name": "dst"
}
},
+ "op": "==",
"right": true
}
}
"name": "mh"
}
},
+ "op": "==",
"right": true
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": false
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": 1
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": 0
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": true
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": false
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": true
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": false
}
}
"name": "frag"
}
},
+ "op": "==",
"right": "tcp"
}
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
"esp",
"name": "frag"
}
},
+ "op": "==",
"right": "esp"
}
}
"name": "frag"
}
},
+ "op": "==",
"right": "ah"
}
}
"name": "frag"
}
},
+ "op": "==",
"right": 22
}
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "frag"
}
},
+ "op": "==",
"right": 22
}
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "frag"
}
},
+ "op": "==",
"right": 1
}
}
"name": "frag"
}
},
+ "op": "==",
"right": 0
}
}
"name": "frag"
}
},
+ "op": "==",
"right": 1
}
}
"name": "frag"
}
},
+ "op": "==",
"right": 1
}
}
"name": "frag"
}
},
+ "op": "==",
"right": 22
}
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "frag"
}
},
+ "op": "==",
"right": 6
}
}
"name": "frag"
}
},
+ "op": "==",
"right": {
"set": [
6,
"name": "frag"
}
},
+ "op": "==",
"right": 50
}
}
"name": "frag"
}
},
+ "op": "==",
"right": 51
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": 22
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "hbh"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "hbh"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "hbh"
}
},
+ "op": "==",
"right": {
"set": [
"esp",
"name": "hbh"
}
},
+ "op": "==",
"right": 22
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "hbh"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "hbh"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "hbh"
}
},
+ "op": "==",
"right": "ip"
}
}
"name": "hbh"
}
},
+ "op": "==",
"right": {
"set": [ 6, 17, 33, 50, 51, 58, 108, 132, 136 ]
}
"name": "hbh"
}
},
+ "op": "==",
"right": 0
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "destination-unreachable"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "packet-too-big"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "time-exceeded"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-request"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "echo-reply"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "mld-listener-query"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "mld-listener-report"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "mld-listener-done"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "mld-listener-reduction"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-solicit"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-neighbor-solicit"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-neighbor-advert"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-redirect"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "parameter-problem"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "router-renumbering"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "ind-neighbor-solicit"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "ind-neighbor-advert"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "mld2-listener-report"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
"destination-unreachable",
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
"router-renumbering",
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
"mld-listener-query",
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": 4
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"range": [ 3, 66 ]
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
5,
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 3, 66 ] }
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": 2222
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"range": [ 222, 226 ]
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
222,
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 222, 226 ] }
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": 2
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
3,
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
2,
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"range": [ 2, 4 ]
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 2, 4 ] }
"name": "icmpv6"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "mld-listener-done"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
"time-exceeded",
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": {
"set": [
"time-exceeded",
"protocol": "ip6"
}
},
+ "op": "==",
"right": "cs1"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "0x38"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
"cs0",
"protocol": "ip6"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ip6"
}
},
+ "op": "==",
"right": 22
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
{
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
"udp",
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
"esp",
"protocol": "ip6"
}
},
+ "op": "==",
"right": "esp"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 44 ] }
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"range": [ 33, 44 ]
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
33,
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1234:1234:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234::1234:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234::1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:0:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234::1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:0:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234::1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234:1234:0:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234:1234:1234::"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1234:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234::1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234::1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234::1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234::1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234::1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234:1234::"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234::1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234::1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234::1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234::1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234::"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234::1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234::1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234::1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234::"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234::1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234::1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234::"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234::1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234::"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234::"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"prefix": {
"addr": "::",
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::1"
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::2"
}
}
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "cs7"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
"cs0",
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [
6,
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"set": [ 6, 17, 33, 50, 51, 58, 108, 132, 136 ]
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": 50
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "0:1234:1234:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:0:1234:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:0:1234:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:0:1234:1234:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234:0:1234:1234"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "1234:1234:1234:1234:1234:1234:1234:0"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "::18.52.18.52"
}
}
"left": {
"meta": { "key": "iif" }
},
+ "op": "==",
"right": "lo"
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 6
}
},
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 6
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
1,
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"range": [ "fe00::1", "fe00::200" ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"key": "state"
}
},
+ "op": "in",
"right": [
"established",
"new"
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": "ipv6-icmp"
}
},
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": "icmp"
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"left": {
"meta": { "key": "l4proto" }
},
+ "op": "==",
"right": 1
}
},
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmpv6"
}
},
+ "op": "==",
"right": "nd-router-advert"
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"protocol": "icmp"
}
},
+ "op": "==",
"right": "echo-request"
}
}
"name": "mh"
}
},
+ "op": "==",
"right": 1
}
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
"udplite",
"name": "mh"
}
},
+ "op": "==",
"right": "icmp"
}
}
"name": "mh"
}
},
+ "op": "==",
"right": 22
}
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
{
"name": "mh"
}
},
+ "op": "==",
"right": 22
}
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
"binding-refresh-request",
"name": "mh"
}
},
+ "op": "==",
"right": "home-agent-switch-message"
}
}
"name": "mh"
}
},
+ "op": "==",
"right": 22
}
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "mh"
}
},
+ "op": "==",
"right": 22
}
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "mh"
}
},
+ "op": "==",
"right": {
"set": [
6,
"name": "mh"
}
},
+ "op": "==",
"right": 1
}
}
"protocol": "udp"
}
},
+ "op": "==",
"right": 954
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "fe00::cafe"
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 1234
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "fe00::cafe"
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 9998
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": "tcp"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 39128
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 9128
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": 9128
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"set": [
1,
"protocol": "ip6"
}
},
+ "op": "==",
"right": {
"range": [ "fe00::1", "fe00::200" ]
}
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"left": {
"meta": { "key": "iifname" }
},
+ "op": "==",
"right": "eth0"
}
},
"key": "state"
}
},
+ "op": "in",
"right": [
"established",
"new"
"protocol": "ip6"
}
},
+ "op": "==",
"right": 6
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "udp"
}
},
+ "op": "==",
"right": 53
}
},
"protocol": "ip6"
}
},
+ "op": "==",
"right": 6
}
},
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": "0x80000000"
}
},
"left": {
"meta": { "key": "mark" }
},
+ "op": "==",
"right": 2147483648
}
},
"name": "rt"
}
},
+ "op": "==",
"right": 1
}
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
"udplite",
"name": "rt"
}
},
+ "op": "==",
"right": "icmp"
}
}
"name": "rt"
}
},
+ "op": "==",
"right": 22
}
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "rt"
}
},
+ "op": "==",
"right": 22
}
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "rt"
}
},
+ "op": "==",
"right": 22
}
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "rt"
}
},
+ "op": "==",
"right": 22
}
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"range": [ 33, 45 ]
}
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
33,
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
"name": "rt"
}
},
+ "op": "==",
"right": {
"set": [
6,
"name": "rt"
}
},
+ "op": "==",
"right": 1
}
}
"key": "nexthop"
}
},
+ "op": "==",
"right": "fd00::1"
}
}
"protocol": "ip6"
}
},
+ "op": "==",
"right": "@set2"
}
},
}
]
},
+ "op": "==",
"right": "@set5"
}
},
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 80, 90 ]
}
"protocol": "tcp"
}
},
+ "op": "==",
"right": {
"range": [ 80, 90 ]
}
"name": "srh"
}
},
+ "op": "==",
"right": 0
}
}
"name": "srh"
}
},
+ "op": "==",
"right": 127
}
}
"name": "srh"
}
},
+ "op": "==",
"right": {
"set": [
0,
"name": "srh"
}
},
+ "op": "==",
"right": 0
}
}
"name": "srh"
}
},
+ "op": "==",
"right": 127
}
}
"name": "srh"
}
},
+ "op": "==",
"right": {
"set": [
0,
"name": "srh"
}
},
+ "op": "==",
"right": 0
}
}
"name": "srh"
}
},
+ "op": "==",
"right": 127
}
}
"name": "srh"
}
},
+ "op": "==",
"right": {
"set": [
0,
"name": "srh"
}
},
+ "op": "==",
"right": "dead::beef"
}
}
"name": "srh"
}
},
+ "op": "==",
"right": "dead::beef"
}
}
"name": "srh"
}
},
+ "op": "==",
"right": {
"set": [
0,
"name": "eol"
}
},
+ "op": "==",
"right": 1
}
}
"name": "noop"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "maxseg"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "window"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack-permitted"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack-permitted"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack1"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack2"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack3"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack0"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack1"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack2"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack3"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "timestamp"
}
},
+ "op": "==",
"right": 1
}
}
"name": "sack"
}
},
+ "op": "==",
"right": 1
}
}
projects / thirdparty / nftables.git / commitdiff
