1ematch(8)                            Linux                           ematch(8)
2
3
4

NAME

6       ematch - extended matches for use with "basic" or "flow" filters
7

SYNOPSIS

9       tc filter add .. basic match EXPR .. flowid ..
10
11
12       EXPR := TERM [ { and | or } EXPR ]
13
14       TERM := [ not ] { MATCH | '(' EXPR ')' }
15
16       MATCH := module '(' ARGS ')'
17
18       ARGS := ARG1 ARG2 ..
19
20

MATCHES

22   cmp
23       Simple comparison ematch: arithmetic compare of packet data to a given
24       value.
25
26       cmp( ALIGN at OFFSET [ ATTRS ] { eq | lt | gt } VALUE )
27
28       ALIGN := { u8 | u16 | u32 }
29
30       ATTRS := [ layer LAYER ] [ mask MASK ] [ trans ]
31
32       LAYER := { link | network | transport | 0..2 }
33
34
35   meta
36       Metadata ematch
37
38       meta( OBJECT { eq | lt |gt } OBJECT )
39
40       OBJECT := { META_ID |  VALUE }
41
42       META_ID := id [ shift SHIFT ] [ mask MASK ]
43
44
45       meta attributes:
46
47              random 32 bit random value
48
49              loadavg_1 Load average in last 5 minutes
50
51              nf_mark Netfilter mark
52
53              vlan Vlan tag
54
55              sk_rcvbuf Receive buffer size
56
57              sk_snd_queue Send queue length
58
59
60       A full list of meta attributes can be obtained via
61
62       # tc filter add dev eth1 basic match 'meta(list)'
63
64
65   nbyte
66       match packet data byte sequence
67
68       nbyte( NEEDLE at OFFSET [ layer LAYER ] )
69
70       NEEDLE := { string | c-escape-sequence  }
71
72       OFFSET := int
73
74       LAYER := { link | network | transport | 0..2 }
75
76
77   u32
78       u32 ematch
79
80       u32( ALIGN VALUE MASK at [ nexthdr+ ] OFFSET )
81
82       ALIGN := { u8 | u16 | u32 }
83
84
85   ipset
86       test packet against ipset membership
87
88       ipset( SETNAME FLAGS )
89
90       SETNAME := string
91
92       FLAGS := { FLAG [, FLAGS] }
93
94       The flag options are the same as those used by the iptables "set"
95       match.
96
97       When using the ipset ematch with the "ip_set_hash:net,iface" set type,
98       the interface can be queried using "src,dst (source ip address, outgo‐
99       ing interface) or "src,src" (source ip address, incoming interface)
100       syntax.
101
102
103   ipt
104       test packet against xtables matches
105
106       ipt( [-6] -m MATCH_NAME FLAGS )
107
108       MATCH_NAME := string
109
110       FLAGS := { FLAG [, FLAGS] }
111
112       The flag options are the same as those used by the xtable match used.
113
114

CAVEATS

116       The ematch syntax uses '(' and ')' to group expressions. All braces
117       need to be escaped properly to prevent shell commandline from inter‐
118       preting these directly.
119
120       When using the ipset ematch with the "ifb" device, the outgoing device
121       will be the ifb device itself, e.g. "ifb0".  The original interface
122       (i.e. the device the packet arrived on) is treated as the incoming
123       interface.
124
125

EXAMPLE & USAGE

127       # tc filter add .. basic match ...
128
129       # 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'
130
131       # 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'
132
133       # 'nbyte("ababa" at 12 layer 1)'
134
135       # 'u32(u16 0x1122 0xffff at nexthdr+4)'
136
137       Check if packet source ip address is member of set named bulk:
138
139       # 'ipset(bulk src)'
140
141       Check if packet source ip and the interface the packet arrived on is
142       member of "hash:net,iface" set named interactive:
143
144       # 'ipset(interactive src,src)'
145
146       Check if packet matches an IPSec state with reqid 1:
147
148       # 'ipt(-m policy --dir in --pol ipsec --reqid 1)'
149
150

AUTHOR

152       The extended match infrastructure was added by Thomas Graf.
153
154
155
156iproute2                         6 August 2012                       ematch(8)