"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "echo-reply"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "destination-unreachable"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "source-quench"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "redirect"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "echo-request"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "time-exceeded"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "parameter-problem"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "timestamp-request"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "timestamp-reply"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "info-request"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "info-reply"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "address-mask-request"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "address-mask-reply"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "router-advertisement"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": "router-solicitation"
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
"echo-reply",
"source-quench",
"redirect",
"echo-request",
+ "router-advertisement",
+ "router-solicitation",
"time-exceeded",
"parameter-problem",
"timestamp-request",
"info-request",
"info-reply",
"address-mask-request",
- "address-mask-reply",
- "router-advertisement",
- "router-solicitation"
+ "address-mask-reply"
]
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 111
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
- "range": [ 33, 55 ]
+ "range": [
+ 33,
+ 55
+ ]
}
}
}
},
"op": "!=",
"right": {
- "range": [ 33, 55 ]
+ "range": [
+ 33,
+ 55
+ ]
}
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
"op": "!=",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- 2,
- 4,
+ "prot-unreachable",
+ "frag-needed",
33,
54,
56
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 12343
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
- "range": [ 11, 343 ]
+ "range": [
+ 11,
+ 343
+ ]
}
}
},
},
"op": "!=",
"right": {
- "range": [ 11, 343 ]
+ "range": [
+ 11,
+ 343
+ ]
}
}
},
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- { "range": [ 11, 343 ] }
+ {
+ "range": [
+ 11,
+ 343
+ ]
+ }
]
}
}
"op": "!=",
"right": {
"set": [
- { "range": [ 11, 343 ] }
+ {
+ "range": [
+ 11,
+ 343
+ ]
+ }
]
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- 1111,
222,
- 343
+ 343,
+ 1111
]
}
}
"op": "!=",
"right": {
"set": [
- 1111,
222,
- 343
+ 343,
+ 1111
]
}
}
# icmp id 1245 log
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 1245
}
},
# icmp id 22
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 22
}
}
# icmp id != 233
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
# icmp id 33-45
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
# icmp id != 33-45
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
},
"op": "!=",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
# icmp id { 33-55}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
# icmp id != { 33-55}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"op": "!=",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
# icmp id { 22, 34, 333}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
22,
# icmp id != { 22, 34, 333}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
# icmp sequence 22
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 22
}
}
# icmp sequence != 233
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
# icmp sequence 33-45
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
# icmp sequence != 33-45
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
},
"op": "!=",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
# icmp sequence { 33, 55, 67, 88}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
33,
# icmp sequence != { 33, 55, 67, 88}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
# icmp sequence { 33-55}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
# icmp sequence != { 33-55}
[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
{
"match": {
"left": {
"op": "!=",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
+ ]
+ }
+ }
+ }
+]
+
+# icmp id 1 icmp sequence 2
+[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
+ ]
+ }
+ }
+ },
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "id",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": 1
+ }
+ },
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "sequence",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": 2
+ }
+ }
+]
+
+# icmp type { echo-reply, echo-request} icmp id 1 icmp sequence 2
+[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": {
+ "set": [
+ "echo-reply",
+ "echo-request"
]
}
}
+ },
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "id",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": 1
+ }
+ },
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "sequence",
+ "protocol": "icmp"
+ }
+ },
+ "op": "==",
+ "right": 2
+ }
}
]
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 33
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
- "range": [ 22, 33 ]
+ "range": [
+ 22,
+ 33
+ ]
}
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- { "range": [ 22, 33 ] }
+ {
+ "range": [
+ 22,
+ 33
+ ]
+ }
]
}
}
"op": "!=",
"right": {
"set": [
- { "range": [ 22, 33 ] }
+ {
+ "range": [
+ 22,
+ 33
+ ]
+ }
]
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 22
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
},
"op": "!=",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
33,
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
"op": "!=",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": 22
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
},
"op": "!=",
"right": {
- "range": [ 33, 45 ]
+ "range": [
+ 33,
+ 45
+ ]
}
}
}
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
33,
"protocol": "icmp"
}
},
- "op": "==",
+ "op": "==",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}
"op": "!=",
"right": {
"set": [
- { "range": [ 33, 55 ] }
+ {
+ "range": [
+ 33,
+ 55
+ ]
+ }
]
}
}