Chapter 2 - Features set
User Manual
R5000 series - Web GUI
60
For example: “pppoes && ppp proto 0x21” filters IPv4
protocols encapsulated in PPPoE
tcp
,
udp
,
icmp
Abbreviations for: “ip proto p”, where “
p
” is one of the
above protocols
iso
proto
protocol
True if the packet is an OSI packet of
protocol
type protocol
Protocol
can be a number or one of the names
clnp
,
esis
,
or
isis
clnp
,
esis
,
isis
Abbreviations for: “iso proto p”, where “
p
” is one of the
above protocols
expr relop expr
True if the relation holds, where relop is one of >, <, >=,
<=, =, !=, and
expr
is an arithmetic expression composed
of integer constants (expressed in standard C syntax), the
normal binary operators [+, -, *, /, &, |, <<, >>], a length
operator, and special packet data accessors
Note that all comparisons are unsigned, so that, for
example, 0x80000000 and 0xffffffff are > 0
To access data inside the packet, use the following syntax:
“proto [ expr : size ]”
Proto
is one of
ether
,
fddi
,
tr
,
wlan
,
ppp
,
slip
,
link
,
ip
,
arp
,
rarp
,
tcp
,
udp
,
icmp
, and indicates the protocol layer
for the index operation (
ether
,
fddi
,
wlan
,
tr
,
ppp
,
slip
and
link
all refer to the link layer)
tcp
,
udp
and other upper-layer protocol types only apply to
IPv4
The byte offset, relative to the indicated protocol layer, is
given by
expr
Size
is optional and indicates the number of bytes in the
field of interest; it can be one, two, or four, and defaults to
one
The length operator, indicated by the keyword len, gives
the length of the packet
For example, “ether[0] & 1 != 0” catches all multicast traffic
The expression “ip[0] & 0xf != 5” catches all IPv4 packets
with options
The expression “ip[6:2] & 0x1fff = 0” catches only
unfragmented IPv4 datagrams and frag zero of fragmented
IPv4 datagrams
This check is implicitly applied to the
tcp
and
udp
index
operations
