1ematch(8)                            Linux                           ematch(8)
2
3
4

NAME

6       ematch - extended matches for use with "basic" or "flow" filters
7

SYNOPSIS

9       tc filter add .. basic match EXPR .. flowid ..
10
11
12       EXPR := TERM [ { and | or } EXPR ]
13
14       TERM := [ not ] { MATCH | '(' EXPR ')' }
15
16       MATCH := module '(' ARGS ')'
17
18       ARGS := ARG1 ARG2 ..
19
20

MATCHES

22   cmp
23       Simple comparison ematch: arithmetic compare of packet data to a given
24       value.
25
26       cmp( ALIGN at OFFSET [ ATTRS ] { eq | lt | gt } VALUE )
27
28       ALIGN := { u8 | u16 | u32 }
29
30       ATTRS := [ layer LAYER ] [ mask MASK ] [ trans ]
31
32       LAYER := { link | network | transport | 0..2 }
33
34
35   meta
36       Metadata ematch
37
38       meta( OBJECT { eq | lt |gt } OBJECT )
39
40       OBJECT := { META_ID |  VALUE }
41
42       META_ID := id [ shift SHIFT ] [ mask MASK ]
43
44
45       meta attributes:
46
47              random 32 bit random value
48
49              loadavg_1 Load average in last 5 minutes
50
51              nf_mark Netfilter mark
52
53              vlan Vlan tag
54
55              sk_rcvbuf Receive buffer size
56
57              sk_snd_queue Send queue length
58
59
60       A full list of meta attributes can be obtained via
61
62       # tc filter add dev eth1 basic match 'meta(list)'
63
64
65   nbyte
66       match packet data byte sequence
67
68       nbyte( NEEDLE at OFFSET [ layer LAYER ] )
69
70       NEEDLE := { string | c-escape-sequence  }
71
72       OFFSET := int
73
74       LAYER := { link | network | transport | 0..2 }
75
76
77   u32
78       u32 ematch
79
80       u32( ALIGN VALUE MASK at [ nexthdr+ ] OFFSET )
81
82       ALIGN := { u8 | u16 | u32 }
83
84
85   ipset
86       test packet against ipset membership
87
88       ipset( SETNAME FLAGS )
89
90       SETNAME := string
91
92       FLAGS := { FLAG [, FLAGS] }
93
94       The flag options are the same as those used by the iptables "set"
95       match.
96
97       When using the ipset ematch with the "ip_set_hash:net,iface" set type,
98       the interface can be queried using "src,dst (source ip address, outgo‐
99       ing interface) or "src,src" (source ip address, incoming interface)
100       syntax.
101
102

CAVEATS

104       The ematch syntax uses '(' and ')' to group expressions. All braces
105       need to be escaped properly to prevent shell commandline from inter‐
106       preting these directly.
107
108       When using the ipset ematch with the "ifb" device, the outgoing device
109       will be the ifb device itself, e.g. "ifb0".  The original interface
110       (i.e. the device the packet arrived on) is treated as the incoming
111       interface.
112
113

EXAMPLE & USAGE

115       # tc filter add .. basic match ...
116
117       # 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'
118
119       # 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'
120
121       # 'nbyte("ababa" at 12 layer 1)'
122
123       # 'u32(u16 0x1122 0xffff at nexthdr+4)'
124
125       Check if packet source ip address is member of set named bulk:
126
127       # 'ipset(bulk src)'
128
129       Check if packet source ip and the interface the packet arrived on is
130       member of "hash:net,iface" set named interactive:
131
132       # 'ipset(interactive src,src)'
133
134

AUTHOR

136       The extended match infrastructure was added by Thomas Graf.
137
138
139
140iproute2                         6 August 2012                       ematch(8)