build: rename sed source files to .in

Prepare for autoconf-based substitution of macros in the file.

Signed-off-by: Florian Westphal <fw@strlen.de>

1 files changed, 0 insertions, 1134 deletions

diff --git a/ebtables.8 b/ebtables.8
deleted file mode 100644
index e3290fe..0000000
--- a/ebtables.8
+++ /dev/null
@@ -1,1134 +0,0 @@
-.TH EBTABLES 8  "$(DATE)"
-.\"
-.\" Man page written by Bart De Schuymer <bdschuym@pandora.be>
-.\" It is based on the iptables man page.
-.\"
-.\" The man page was edited, February 25th 2003, by 
-.\"      Greg Morgan <" dr_kludge_at_users_sourceforge_net >
-.\"
-.\" Iptables page by Herve Eychenne March 2000.
-.\"
-.\"     This program is free software; you can redistribute it and/or modify
-.\"     it under the terms of the GNU General Public License as published by
-.\"     the Free Software Foundation; either version 2 of the License, or
-.\"     (at your option) any later version.
-.\"
-.\"     This program is distributed in the hope that it will be useful,
-.\"     but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\"     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\"     GNU General Public License for more details.
-.\"
-.\"     You should have received a copy of the GNU General Public License
-.\"     along with this program; if not, write to the Free Software
-.\"     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-.\"     
-.\"
-.SH NAME
-ebtables (v$(VERSION)) \- Ethernet bridge frame table administration
-.SH SYNOPSIS
-.BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target"
-.br
-.BR "ebtables " [ -t " table ] " -P " chain " ACCEPT " | " DROP " | " RETURN
-.br
-.BR "ebtables " [ -t " table ] " -F " [chain]"
-.br
-.BR "ebtables " [ -t " table ] " -Z " [chain]"
-.br
-.BR "ebtables " [ -t " table ] " -L " [" -Z "] [chain] [ [" --Ln "] | [" --Lx "] ] [" --Lc "] [" --Lmac2 ]
-.br
-.BR "ebtables " [ -t " table ] " -N " chain [" "-P ACCEPT " | " DROP " | " RETURN" ]
-.br
-.BR "ebtables " [ -t " table ] " -X " [chain]"
-.br
-.BR "ebtables " [ -t " table ] " -E " old-chain-name new-chain-name"
-.br
-.BR "ebtables " [ -t " table ] " --init-table
-.br
-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit
-.br
-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init
-.br
-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save
-.br
-.SH DESCRIPTION
-.B ebtables
-is an application program used to set up and maintain the
-tables of rules (inside the Linux kernel) that inspect
-Ethernet frames.
-It is analogous to the
-.B iptables
-application, but less complicated, due to the fact that the Ethernet protocol
-is much simpler than the IP protocol.
-.SS CHAINS
-There are three ebtables tables with built-in chains in the
-Linux kernel. These tables are used to divide functionality into
-different sets of rules. Each set of rules is called a chain.
-Each chain is an ordered list of rules that can match Ethernet frames. If a
-rule matches an Ethernet frame, then a processing specification tells
-what to do with that matching frame. The processing specification is
-called a 'target'. However, if the frame does not match the current
-rule in the chain, then the next rule in the chain is examined and so forth.
-The user can create new (user-defined) chains that can be used as the 'target'
-of a rule. User-defined chains are very useful to get better performance
-over the linear traversal of the rules and are also essential for structuring
-the filtering rules into well-organized and maintainable sets of rules.
-.SS TARGETS
-A firewall rule specifies criteria for an Ethernet frame and a frame
-processing specification called a target.  When a frame matches a rule,
-then the next action performed by the kernel is specified by the target.
-The target can be one of these values:
-.BR ACCEPT ,
-.BR DROP ,
-.BR CONTINUE ,
-.BR RETURN ,
-an 'extension' (see below) or a jump to a user-defined chain.
-.PP
-.B ACCEPT
-means to let the frame through.
-.B DROP
-means the frame has to be dropped. In the
-.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different"
-meanings (see the info provided for the
-.BR -t " option)."
-.B CONTINUE
-means the next rule has to be checked. This can be handy, f.e., to know how many
-frames pass a certain point in the chain, to log those frames or to apply multiple
-targets on a frame.
-.B RETURN
-means stop traversing this chain and resume at the next rule in the
-previous (calling) chain.
-For the extension targets please refer to the
-.B "TARGET EXTENSIONS"
-section of this man page.
-.SS TABLES
-As stated earlier, there are three ebtables tables in the Linux
-kernel.  The table names are
-.BR filter ", " nat " and " broute .
-Of these three tables,
-the filter table is the default table that the command operates on.
-If you are working with the filter table, then you can drop the '-t filter'
-argument to the ebtables command.  However, you will need to provide
-the -t argument for the other two tables.  Moreover, the -t argument must be the
-first argument on the ebtables command line, if used. 
-.TP
-.B "-t, --table"
-.br
-.B filter
-is the default table and contains three built-in chains:
-.B INPUT 
-(for frames destined for the bridge itself, on the level of the MAC destination address), 
-.B OUTPUT 
-(for locally-generated or (b)routed frames) and
-.B FORWARD 
-(for frames being forwarded by the bridge).
-.br
-.br
-.B nat
-is mostly used to change the mac addresses and contains three built-in chains:
-.B PREROUTING 
-(for altering frames as soon as they come in), 
-.B OUTPUT 
-(for altering locally generated or (b)routed frames before they are bridged) and 
-.B POSTROUTING
-(for altering frames as they are about to go out). A small note on the naming
-of chains PREROUTING and POSTROUTING: it would be more accurate to call them
-PREFORWARDING and POSTFORWARDING, but for all those who come from the
-iptables world to ebtables it is easier to have the same names. Note that you
-can change the name
-.BR "" ( -E )
-if you don't like the default.
-.br
-.br
-.B broute
-is used to make a brouter, it has one built-in chain:
-.BR BROUTING .
-The targets
-.BR DROP " and " ACCEPT
-have a special meaning in the broute table (these names are used instead of
-more descriptive names to keep the implementation generic).
-.B DROP
-actually means the frame has to be routed, while
-.B ACCEPT
-means the frame has to be bridged. The
-.B BROUTING
-chain is traversed very early. However, it is only traversed by frames entering on
-a bridge port that is in forwarding state. Normally those frames
-would be bridged, but you can decide otherwise here. The
-.B redirect
-target is very handy here.
-.SH EBTABLES COMMAND LINE ARGUMENTS
-After the initial ebtables '-t table' command line argument, the remaining
-arguments can be divided into several groups.  These groups
-are commands, miscellaneous commands, rule specifications, match extensions,
-watcher extensions and target extensions.
-.SS COMMANDS
-The ebtables command arguments specify the actions to perform on the table
-defined with the -t argument.  If you do not use the -t argument to name
-a table, the commands apply to the default filter table.
-Only one command may be used on the command line at a time, except when
-the commands
-.BR -L " and " -Z
-are combined, the commands
-.BR -N " and " -P
-are combined, or when
-.B --atomic-file
-is used.
-.TP
-.B "-A, --append"
-Append a rule to the end of the selected chain.
-.TP
-.B "-D, --delete"
-Delete the specified rule or rules from the selected chain. There are two ways to
-use this command. The first is by specifying an interval of rule numbers
-to delete (directly after
-.BR -D ).
-Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use
-.B -L --Ln
-to list the rules with their rule number). When \fIend_nr\fP is omitted, all rules starting
-from \fIstart_nr\fP are deleted. Using negative numbers is allowed, for more
-details about using negative numbers, see the
-.B -I
-command. The second usage is by
-specifying the complete rule as it would have been specified when it was added. Only
-the first encountered rule that is the same as this specified rule, in other
-words the matching rule with the lowest (positive) rule number, is deleted.
-.TP
-.B "-C, --change-counters"
-Change the counters of the specified rule or rules from the selected chain. There are two ways to
-use this command. The first is by specifying an interval of rule numbers
-to do the changes on (directly after
-.BR -C ).
-Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use
-.B -L --Ln
-to list the rules with their rule number). The details are the same as for the
-.BR -D " command. The second usage is by"
-specifying the complete rule as it would have been specified when it was added. Only
-the counters of the first encountered rule that is the same as this specified rule, in other
-words the matching rule with the lowest (positive) rule number, are changed.
-In the first usage, the counters are specified directly after the interval specification,
-in the second usage directly after
-.BR -C .
-First the packet counter is specified, then the byte counter. If the specified counters start
-with a '+', the counter values are added to the respective current counter values.
-If the specified counters start with a '-', the counter values are decreased from the respective
-current counter values. No bounds checking is done. If the counters don't start with '+' or '-',
-the current counters are changed to the specified counters.
-.TP
-.B "-I, --insert"
-Insert the specified rule into the selected chain at the specified rule number. If the
-rule number is not specified, the rule is added at the head of the chain.
-If the current number of rules equals
-.IR N ,
-then the specified number can be
-between
-.IR -N " and " N+1 .
-For a positive number
-.IR i ,
-it holds that
-.IR i " and " i-N-1
-specify the same place in the chain where the rule should be inserted. The rule number
-0 specifies the place past the last rule in the chain and using this number is therefore
-equivalent to using the
-.BR -A " command."
-Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted
-in a chain.
-.TP
-.B "-P, --policy"
-Set the policy for the chain to the given target. The policy can be
-.BR ACCEPT ", " DROP " or " RETURN .
-.TP
-.B "-F, --flush"
-Flush the selected chain. If no chain is selected, then every chain will be
-flushed. Flushing a chain does not change the policy of the
-chain, however.
-.TP
-.B "-Z, --zero"
-Set the counters of the selected chain to zero. If no chain is selected, all the counters
-are set to zero. The
-.B "-Z"
-command can be used in conjunction with the 
-.B "-L"
-command.
-When both the
-.B "-Z"
-and
-.B "-L"
-commands are used together in this way, the rule counters are printed on the screen
-before they are set to zero.
-.TP
-.B "-L, --list"
-List all rules in the selected chain. If no chain is selected, all chains
-are listed.
-.br
-The following options change the output of the
-.B "-L"
-command.
-.br
-.B "--Ln"
-.br
-Places the rule number in front of every rule. This option is incompatible with the
-.BR --Lx " option."
-.br
-.B "--Lc"
-.br
-Shows the counters at the end of each rule displayed by the
-.B "-L"
-command. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed.
-The frame counter shows how many frames have matched the specific rule, the byte
-counter shows the sum of the frame sizes of these matching frames. Using this option
-.BR "" "in combination with the " --Lx " option causes the counters to be written out"
-.BR "" "in the '" -c " <pcnt> <bcnt>' option format."
-.br
-.B "--Lx"
-.br
-Changes the output so that it produces a set of ebtables commands that construct
-the contents of the chain, when specified.
-If no chain is specified, ebtables commands to construct the contents of the
-table are given, including commands for creating the user-defined chains (if any).
-You can use this set of commands in an ebtables boot or reload
-script.  For example the output could be used at system startup.
-The 
-.B "--Lx"
-option is incompatible with the
-.B "--Ln"
-listing option. Using the
-.BR --Lx " option together with the " --Lc " option will cause the counters to be written out"
-.BR "" "in the '" -c " <pcnt> <bcnt>' option format."
-.br
-.B "--Lmac2"
-.br
-Shows all MAC addresses with the same length, adding leading zeroes
-if necessary. The default representation omits leading zeroes in the addresses.
-.TP
-.B "-N, --new-chain"
-Create a new user-defined chain with the given name. The number of
-user-defined chains is limited only by the number of possible chain names.
-A user-defined chain name has a maximum
-length of 31 characters. The standard policy of the user-defined chain is
-ACCEPT. The policy of the new chain can be initialized to a different standard
-target by using the
-.B -P
-command together with the
-.B -N
-command. In this case, the chain name does not have to be specified for the
-.B -P
-command.
-.TP
-.B "-X, --delete-chain"
-Delete the specified user-defined chain. There must be no remaining references (jumps)
-to the specified chain, otherwise ebtables will refuse to delete it. If no chain is
-specified, all user-defined chains that aren't referenced will be removed.
-.TP
-.B "-E, --rename-chain"
-Rename the specified chain to a new name.  Besides renaming a user-defined
-chain, you can rename a standard chain to a name that suits your
-taste. For example, if you like PREFORWARDING more than PREROUTING,
-then you can use the -E command to rename the PREROUTING chain. If you do
-rename one of the standard ebtables chain names, please be sure to mention
-this fact should you post a question on the ebtables mailing lists.
-It would be wise to use the standard name in your post. Renaming a standard
-ebtables chain in this fashion has no effect on the structure or functioning
-of the ebtables kernel table.
-.TP
-.B "--init-table"
-Replace the current table data by the initial table data.
-.TP
-.B "--atomic-init"
-Copy the kernel's initial data of the table to the specified
-file. This can be used as the first action, after which rules are added
-to the file. The file can be specified using the
-.B --atomic-file
-command or through the
-.IR EBTABLES_ATOMIC_FILE " environment variable."
-.TP
-.B "--atomic-save"
-Copy the kernel's current data of the table to the specified
-file. This can be used as the first action, after which rules are added
-to the file. The file can be specified using the
-.B --atomic-file
-command or through the
-.IR EBTABLES_ATOMIC_FILE " environment variable."
-.TP
-.B "--atomic-commit"
-Replace the kernel table data with the data contained in the specified
-file. This is a useful command that allows you to load all your rules of a
-certain table into the kernel at once, saving the kernel a lot of precious
-time and allowing atomic updates of the tables. The file which contains
-the table data is constructed by using either the
-.B "--atomic-init"
-or the
-.B "--atomic-save"
-command to generate a starting file. After that, using the
-.B "--atomic-file"
-command when constructing rules or setting the
-.IR EBTABLES_ATOMIC_FILE " environment variable"
-allows you to extend the file and build the complete table before
-committing it to the kernel. This command can be very useful in boot scripts
-to populate the ebtables tables in a fast way.
-.SS MISCELLANOUS COMMANDS
-.TP
-.B "-V, --version"
-Show the version of the ebtables userspace program.
-.TP
-.BR "-h, --help " "[\fIlist of module names\fP]"
-Give a brief description of the command syntax. Here you can also specify
-names of extensions and ebtables will try to write help about those
-extensions. E.g.
-.IR "ebtables -h snat log ip arp" .
-Specify
-.I list_extensions
-to list all extensions supported by the userspace
-utility.
-.TP
-.BR "-j, --jump " "\fItarget\fP"
-The target of the rule. This is one of the following values:
-.BR ACCEPT ,
-.BR DROP ,
-.BR CONTINUE ,
-.BR RETURN ,
-a target extension (see
-.BR "TARGET EXTENSIONS" ")"
-or a user-defined chain name.
-.TP
-.B --atomic-file "\fIfile\fP"
-Let the command operate on the specified
-.IR file .
-The data of the table to
-operate on will be extracted from the file and the result of the operation
-will be saved back into the file. If specified, this option should come
-before the command specification. An alternative that should be preferred,
-is setting the
-.IR EBTABLES_ATOMIC_FILE " environment variable."
-.TP
-.B -M, --modprobe "\fIprogram\fP"
-When talking to the kernel, use this
-.I program
-to try to automatically load missing kernel modules.
-.TP
-.B --concurrent
-Use a file lock to support concurrent scripts updating the ebtables kernel tables.
-
-.SS
-RULE SPECIFICATIONS
-The following command line arguments make up a rule specification (as used 
-in the add and delete commands). A "!" option before the specification 
-inverts the test for that specification. Apart from these standard rule 
-specifications there are some other command line arguments of interest.
-See both the 
-.BR "MATCH EXTENSIONS" 
-and the
-.BR "WATCHER EXTENSIONS" 
-below.
-.TP
-.BR "-p, --protocol " "[!] \fIprotocol\fP"
-The protocol that was responsible for creating the frame. This can be a
-hexadecimal number, above 
-.IR 0x0600 ,
-a name (e.g.
-.I ARP
-) or
-.BR LENGTH .
-The protocol field of the Ethernet frame can be used to denote the
-length of the header (802.2/802.3 networks). When the value of that field is
-below or equals
-.IR 0x0600 ,
-the value equals the size of the header and shouldn't be used as a
-protocol number. Instead, all frames where the protocol field is used as
-the length field are assumed to be of the same 'protocol'. The protocol
-name used in ebtables for these frames is
-.BR LENGTH .
-.br
-The file
-.B /etc/ethertypes
-can be used to show readable
-characters instead of hexadecimal numbers for the protocols. For example,
-.I 0x0800
-will be represented by 
-.IR IPV4 .
-The use of this file is not case sensitive. 
-See that file for more information. The flag 
-.B --proto
-is an alias for this option.
-.TP 
-.BR "-i, --in-interface " "[!] \fIname\fP"
-The interface (bridge port) via which a frame is received (this option is useful in the
-.BR INPUT ,
-.BR FORWARD ,
-.BR PREROUTING " and " BROUTING
-chains). If the interface name ends with '+', then
-any interface name that begins with this name (disregarding '+') will match.
-The flag
-.B --in-if
-is an alias for this option.
-.TP
-.BR "--logical-in " "[!] \fIname\fP"
-The (logical) bridge interface via which a frame is received (this option is useful in the
-.BR INPUT ,
-.BR FORWARD ,
-.BR PREROUTING " and " BROUTING
-chains).
-If the interface name ends with '+', then
-any interface name that begins with this name (disregarding '+') will match.
-.TP
-.BR "-o, --out-interface " "[!] \fIname\fP"
-The interface (bridge port) via which a frame is going to be sent (this option is useful in the
-.BR OUTPUT ,
-.B FORWARD
-and
-.B POSTROUTING
-chains). If the interface name ends with '+', then
-any interface name that begins with this name (disregarding '+') will match.
-The flag
-.B --out-if
-is an alias for this option.
-.TP
-.BR "--logical-out " "[!] \fIname\fP"
-The (logical) bridge interface via which a frame is going to be sent (this option
-is useful in the
-.BR OUTPUT ,
-.B FORWARD
-and
-.B POSTROUTING
-chains).
-If the interface name ends with '+', then
-any interface name that begins with this name (disregarding '+') will match.
-.TP
-.BR "-s, --source " "[!] \fIaddress\fP[/\fImask\fP]"
-The source MAC address. Both mask and address are written as 6 hexadecimal
-numbers separated by colons. Alternatively one can specify Unicast,
-Multicast, Broadcast or BGA (Bridge Group Address):
-.br
-.IR "Unicast" "=00:00:00:00:00:00/01:00:00:00:00:00,"
-.IR "Multicast" "=01:00:00:00:00:00/01:00:00:00:00:00,"
-.IR "Broadcast" "=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or"
-.IR "BGA" "=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff."
-Note that a broadcast
-address will also match the multicast specification. The flag
-.B --src
-is an alias for this option.
-.TP
-.BR "-d, --destination " "[!] \fIaddress\fP[/\fImask\fP]"
-The destination MAC address. See
-.B -s
-(above) for more details on MAC addresses. The flag
-.B --dst
-is an alias for this option.
-.TP
-.BR "-c, --set-counter " "\fIpcnt bcnt\fP"
-If used with
-.BR -A " or " -I ", then the packet and byte counters of the new rule will be set to
-.IR pcnt ", resp. " bcnt ".
-If used with the
-.BR -C " or " -D " commands, only rules with a packet and byte count equal to"
-.IR pcnt ", resp. " bcnt " will match."
-
-.SS MATCH EXTENSIONS
-Ebtables extensions are dynamically loaded into the userspace tool,
-there is therefore no need to explicitly load them with a
--m option like is done in iptables.
-These extensions deal with functionality supported by kernel modules supplemental to
-the core ebtables code.
-.SS 802_3
-Specify 802.3 DSAP/SSAP fields or SNAP type.  The protocol must be specified as
-.IR "LENGTH " "(see the option " " -p " above).
-.TP
-.BR "--802_3-sap " "[!] \fIsap\fP"
-DSAP and SSAP are two one byte 802.3 fields.  The bytes are always
-equal, so only one byte (hexadecimal) is needed as an argument.
-.TP
-.BR "--802_3-type " "[!] \fItype\fP"
-If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must
-be consulted to determine the payload protocol.  This is a two byte
-(hexadecimal) argument.  Only 802.3 frames with DSAP/SSAP 0xaa are
-checked for type.
-.SS among
-Match a MAC address or MAC/IP address pair versus a list of MAC addresses
-and MAC/IP address pairs.
-A list entry has the following format:
-.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple"
-list entries are separated by a comma, specifying an IP address corresponding to
-the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address
-but different IP address (and vice versa) can be specified. If the MAC address doesn't
-match any entry from the list, the frame doesn't match the rule (unless "!" was used).
-.TP
-.BR "--among-dst " "[!] \fIlist\fP"
-Compare the MAC destination to the given list. If the Ethernet frame has type
-.IR IPv4 " or " ARP ,
-then comparison with MAC/IP destination address pairs from the
-list is possible.
-.TP
-.BR "--among-src " "[!] \fIlist\fP"
-Compare the MAC source to the given list. If the Ethernet frame has type
-.IR IPv4 " or " ARP ,
-then comparison with MAC/IP source address pairs from the list
-is possible.
-.TP
-.BR "--among-dst-file " "[!] \fIfile\fP"
-Same as
-.BR --among-dst " but the list is read in from the specified file."
-.TP
-.BR "--among-src-file " "[!] \fIfile\fP"
-Same as
-.BR --among-src " but the list is read in from the specified file."
-.SS arp
-Specify (R)ARP fields. The protocol must be specified as
-.IR ARP " or " RARP .
-.TP
-.BR "--arp-opcode " "[!] \fIopcode\fP"
-The (R)ARP opcode (decimal or a string, for more details see
-.BR "ebtables -h arp" ).
-.TP
-.BR "--arp-htype " "[!] \fIhardware type\fP"
-The hardware type, this can be a decimal or the string
-.I Ethernet
-(which sets
-.I type
-to 1). Most (R)ARP packets have Eternet as hardware type.
-.TP
-.BR "--arp-ptype " "[!] \fIprotocol type\fP"
-The protocol type for which the (r)arp is used (hexadecimal or the string
-.IR IPv4 ,
-denoting 0x0800).
-Most (R)ARP packets have protocol type IPv4.
-.TP
-.BR "--arp-ip-src " "[!] \fIaddress\fP[/\fImask\fP]"
-The (R)ARP IP source address specification.
-.TP
-.BR "--arp-ip-dst " "[!] \fIaddress\fP[/\fImask\fP]"
-The (R)ARP IP destination address specification.
-.TP
-.BR "--arp-mac-src " "[!] \fIaddress\fP[/\fImask\fP]"
-The (R)ARP MAC source address specification.
-.TP
-.BR "--arp-mac-dst " "[!] \fIaddress\fP[/\fImask\fP]"
-The (R)ARP MAC destination address specification.
-.TP
-.BR "" "[!]" " --arp-gratuitous"
-Checks for ARP gratuitous packets: checks equality of IPv4 source
-address and IPv4 destination address inside the ARP header.
-.SS ip
-Specify IPv4 fields. The protocol must be specified as
-.IR IPv4 .
-.TP
-.BR "--ip-source " "[!] \fIaddress\fP[/\fImask\fP]"
-The source IP address.
-The flag
-.B --ip-src
-is an alias for this option.
-.TP
-.BR "--ip-destination " "[!] \fIaddress\fP[/\fImask\fP]"
-The destination IP address.
-The flag
-.B --ip-dst
-is an alias for this option.
-.TP
-.BR "--ip-tos " "[!] \fItos\fP"
-The IP type of service, in hexadecimal numbers.
-.BR IPv4 .
-.TP
-.BR "--ip-protocol " "[!] \fIprotocol\fP"
-The IP protocol.
-The flag
-.B --ip-proto
-is an alias for this option.
-.TP
-.BR "--ip-source-port " "[!] \fIport1\fP[:\fIport2\fP]"
-The source port or port range for the IP protocols 6 (TCP), 17
-(UDP), 33 (DCCP) or 132 (SCTP). The
-.B --ip-protocol
-option must be specified as
-.IR TCP ", " UDP ", " DCCP " or " SCTP .
-If
-.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
-The flag
-.B --ip-sport
-is an alias for this option.
-.TP
-.BR "--ip-destination-port " "[!] \fIport1\fP[:\fIport2\fP]"
-The destination port or port range for ip protocols 6 (TCP), 17
-(UDP), 33 (DCCP) or 132 (SCTP). The
-.B --ip-protocol
-option must be specified as
-.IR TCP ", " UDP ", " DCCP " or " SCTP .
-If
-.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
-The flag
-.B --ip-dport
-is an alias for this option.
-.SS ip6
-Specify IPv6 fields. The protocol must be specified as
-.IR IPv6 .
-.TP
-.BR "--ip6-source " "[!] \fIaddress\fP[/\fImask\fP]"
-The source IPv6 address.
-The flag
-.B --ip6-src
-is an alias for this option.
-.TP
-.BR "--ip6-destination " "[!] \fIaddress\fP[/\fImask\fP]"
-The destination IPv6 address.
-The flag
-.B --ip6-dst
-is an alias for this option.
-.TP
-.BR "--ip6-tclass " "[!] \fItclass\fP"
-The IPv6 traffic class, in hexadecimal numbers.
-.TP
-.BR "--ip6-protocol " "[!] \fIprotocol\fP"
-The IP protocol.
-The flag
-.B --ip6-proto
-is an alias for this option.
-.TP
-.BR "--ip6-source-port " "[!] \fIport1\fP[:\fIport2\fP]"
-The source port or port range for the IPv6 protocols 6 (TCP), 17
-(UDP), 33 (DCCP) or 132 (SCTP). The
-.B --ip6-protocol
-option must be specified as
-.IR TCP ", " UDP ", " DCCP " or " SCTP .
-If
-.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
-The flag
-.B --ip6-sport
-is an alias for this option.
-.TP
-.BR "--ip6-destination-port " "[!] \fIport1\fP[:\fIport2\fP]"
-The destination port or port range for IPv6 protocols 6 (TCP), 17
-(UDP), 33 (DCCP) or 132 (SCTP). The
-.B --ip6-protocol
-option must be specified as
-.IR TCP ", " UDP ", " DCCP " or " SCTP .
-If
-.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used."
-The flag
-.B --ip6-dport
-is an alias for this option.
-.TP
-.BR "--ip6-icmp-type " "[!] {\fItype\fP[:\fItype\fP]/\fIcode\fP[:\fIcode\fP]|\fItypename\fP}"
-Specify ipv6\-icmp type and code to match.
-Ranges for both type and code are supported. Type and code are
-separated by a slash. Valid numbers for type and range are 0 to 255.
-To match a single type including all valid codes, symbolic names can
-be used instead of numbers. The list of known type names is shown by the command
-.nf
-  ebtables \-\-help ip6
-.fi
-This option is only valid for \-\-ip6-prococol ipv6-icmp.
-.SS limit
-This module matches at a limited rate using a token bucket filter.
-A rule using this extension will match until this limit is reached.
-It can be used with the
-.B --log
-watcher to give limited logging, for example. Its use is the same
-as the limit match of iptables.
-.TP
-.BR "--limit " "[\fIvalue\fP]"
-Maximum average matching rate: specified as a number, with an optional
-.IR /second ", " /minute ", " /hour ", or " /day " suffix; the default is " 3/hour .
-.TP
-.BR "--limit-burst " "[\fInumber\fP]"
-Maximum initial number of packets to match: this number gets recharged by
-one every time the limit specified above is not reached, up to this
-number; the default is
-.IR 5 .
-.SS mark_m
-.TP
-.BR "--mark " "[!] [\fIvalue\fP][/\fImask\fP]"
-Matches frames with the given unsigned mark value. If a
-.IR value " and " mask " are specified, the logical AND of the mark value of the frame and"
-the user-specified
-.IR mask " is taken before comparing it with the"
-user-specified mark
-.IR value ". When only a mark "
-.IR value " is specified, the packet"
-only matches when the mark value of the frame equals the user-specified
-mark
-.IR value .
-If only a
-.IR mask " is specified, the logical"
-AND of the mark value of the frame and the user-specified
-.IR mask " is taken and the frame matches when the result of this logical AND is"
-non-zero. Only specifying a
-.IR mask " is useful to match multiple mark values."
-.SS pkttype
-.TP
-.BR "--pkttype-type " "[!] \fItype\fP"
-Matches on the Ethernet "class" of the frame, which is determined by the
-generic networking code. Possible values:
-.IR broadcast " (MAC destination is the broadcast address),"
-.IR multicast " (MAC destination is a multicast address),"
-.IR host " (MAC destination is the receiving network device), or "
-.IR otherhost " (none of the above)."
-.SS stp
-Specify stp BPDU (bridge protocol data unit) fields. The destination
-address
-.BR "" ( -d ") must be specified as the bridge group address"
-.IR "" ( BGA ).
-For all options for which a range of values can be specified, it holds that
-if the lower bound is omitted (but the colon is not), then the lowest possible lower bound
-for that option is used, while if the upper bound is omitted (but the colon again is not), the
-highest possible upper bound for that option is used.
-.TP
-.BR "--stp-type " "[!] \fItype\fP"
-The BPDU type (0-255), recognized non-numerical types are
-.IR config ", denoting a configuration BPDU (=0), and"
-.IR tcn ", denothing a topology change notification BPDU (=128)."
-.TP
-.BR "--stp-flags " "[!] \fIflag\fP"
-The BPDU flag (0-255), recognized non-numerical flags are
-.IR topology-change ", denoting the topology change flag (=1), and"
-.IR topology-change-ack ", denoting the topology change acknowledgement flag (=128)."
-.TP
-.BR "--stp-root-prio " "[!] [\fIprio\fP][:\fIprio\fP]"
-The root priority (0-65535) range.
-.TP
-.BR "--stp-root-addr " "[!] [\fIaddress\fP][/\fImask\fP]"
-The root mac address, see the option
-.BR -s " for more details."
-.TP
-.BR "--stp-root-cost " "[!] [\fIcost\fP][:\fIcost\fP]"
-The root path cost (0-4294967295) range.
-.TP
-.BR "--stp-sender-prio " "[!] [\fIprio\fP][:\fIprio\fP]"
-The BPDU's sender priority (0-65535) range.
-.TP
-.BR "--stp-sender-addr " "[!] [\fIaddress\fP][/\fImask\fP]"
-The BPDU's sender mac address, see the option
-.BR -s " for more details."
-.TP
-.BR "--stp-port " "[!] [\fIport\fP][:\fIport\fP]"
-The port identifier (0-65535) range.
-.TP
-.BR "--stp-msg-age " "[!] [\fIage\fP][:\fIage\fP]"
-The message age timer (0-65535) range.
-.TP
-.BR "--stp-max-age " "[!] [\fIage\fP][:\fIage\fP]"
-The max age timer (0-65535) range.
-.TP
-.BR "--stp-hello-time " "[!] [\fItime\fP][:\fItime\fP]"
-The hello time timer (0-65535) range.
-.TP
-.BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]"
-The forward delay timer (0-65535) range.
-.SS string
-This module matches on a given string using some pattern matching strategy.
-.TP
-.BR "--string-algo " "\fIalgorithm\fP"
-The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
-.TP
-.BR "--string-from " "\fIoffset\fP"
-The lowest offset from which a match can start. (default: 0)
-.TP
-.BR "--string-to " "\fIoffset\fP"
-The highest offset from which a match can start. (default: size of frame)
-.TP
-.BR "--string " "[!] \fIpattern\fP"
-Matches the given pattern.
-.TP
-.BR "--string-hex " "[!] \fIpattern\fP"
-Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|'
-.TP
-.BR "--string-icase"
-Ignore case when searching.
-.SS vlan
-Specify 802.1Q Tag Control Information fields.
-The protocol must be specified as
-.IR 802_1Q " (0x8100)."
-.TP
-.BR "--vlan-id " "[!] \fIid\fP"
-The VLAN identifier field (VID). Decimal number from 0 to 4095.
-.TP
-.BR "--vlan-prio " "[!] \fIprio\fP"
-The user priority field, a decimal number from 0 to 7.
-The VID should be set to 0 ("null VID") or unspecified
-(in the latter case the VID is deliberately set to 0).
-.TP
-.BR "--vlan-encap " "[!] \fItype\fP"
-The encapsulated Ethernet frame type/length.
-Specified as a hexadecimal
-number from 0x0000 to 0xFFFF or as a symbolic name
-from
-.BR /etc/ethertypes .
-
-.SS WATCHER EXTENSIONS
-Watchers only look at frames passing by, they don't modify them nor decide
-to accept the frames or not. These watchers only
-see the frame if the frame matches the rule, and they see it before the
-target is executed.
-.SS log
-The log watcher writes descriptive data about a frame to the syslog.
-.TP
-.B "--log"
-.br
-Log with the default loggin options: log-level=
-.IR info ,
-log-prefix="", no ip logging, no arp logging.
-.TP
-.B --log-level "\fIlevel\fP"
-.br
-Defines the logging level. For the possible values, see
-.BR "ebtables -h log" .
-The default level is 
-.IR info .
-.TP
-.BR --log-prefix " \fItext\fP"
-.br
-Defines the prefix
-.I text
-to be printed at the beginning of the line with the logging information.
-.TP
-.B --log-ip 
-.br
-Will log the ip information when a frame made by the ip protocol matches 
-the rule. The default is no ip information logging.
-.TP
-.B --log-ip6 
-.br
-Will log the ipv6 information when a frame made by the ipv6 protocol matches 
-the rule. The default is no ipv6 information logging.
-.TP
-.B --log-arp
-.br
-Will log the (r)arp information when a frame made by the (r)arp protocols
-matches the rule. The default is no (r)arp information logging.
-.SS nflog
-The nflog watcher passes the packet to the loaded logging backend
-in order to log the packet. This is usually used in combination with
-nfnetlink_log as logging backend, which will multicast the packet
-through a
-.IR netlink
-socket to the specified multicast group. One or more userspace processes
-may subscribe to the group to receive the packets.
-.TP
-.B "--nflog"
-.br
-Log with the default logging options
-.TP
-.B --nflog-group "\fInlgroup\fP"
-.br
-The netlink group (1 - 2^32-1) to which packets are (only applicable for
-nfnetlink_log). The default value is 1.
-.TP
-.B --nflog-prefix "\fIprefix\fP"
-.br
-A prefix string to include in the log message, up to 30 characters
-long, useful for distinguishing messages in the logs.
-.TP
-.B --nflog-range "\fIsize\fP"
-.br
-The number of bytes to be copied to userspace (only applicable for
-nfnetlink_log). nfnetlink_log instances may specify their own
-range, this option overrides it.
-.TP
-.B --nflog-threshold "\fIsize\fP"
-.br
-Number of packets to queue inside the kernel before sending them
-to userspace (only applicable for nfnetlink_log). Higher values
-result in less overhead per packet, but increase delay until the
-packets reach userspace. The default value is 1.
-.SS ulog
-The ulog watcher passes the packet to a userspace
-logging daemon using netlink multicast sockets. This differs
-from the log watcher in the sense that the complete packet is
-sent to userspace instead of a descriptive text and that
-netlink multicast sockets are used instead of the syslog.
-This watcher enables parsing of packets with userspace programs, the
-physical bridge in and out ports are also included in the netlink messages.
-The ulog watcher module accepts 2 parameters when the module is loaded
-into the kernel (e.g. with modprobe):
-.B nlbufsiz
-specifies how big the buffer for each netlink multicast
-group is. If you say
-.IR nlbufsiz=8192 ,
-for example, up to eight kB of packets will
-get accumulated in the kernel until they are sent to userspace. It is
-not possible to allocate more than 128kB. Please also keep in mind that
-this buffer size is allocated for each nlgroup you are using, so the
-total kernel memory usage increases by that factor. The default is 4096.
-.B flushtimeout
-specifies after how many hundredths of a second the queue should be
-flushed, even if it is not full yet. The default is 10 (one tenth of
-a second).
-.TP
-.B "--ulog"
-.br
-Use the default settings: ulog-prefix="", ulog-nlgroup=1,
-ulog-cprange=4096, ulog-qthreshold=1.
-.TP
-.B --ulog-prefix "\fItext\fP"
-.br
-Defines the prefix included with the packets sent to userspace.
-.TP
-.BR --ulog-nlgroup " \fIgroup\fP"
-.br
-Defines which netlink group number to use (a number from 1 to 32).
-Make sure the netlink group numbers used for the iptables ULOG
-target differ from those used for the ebtables ulog watcher.
-The default group number is 1.
-.TP
-.BR --ulog-cprange " \fIrange\fP"
-.br
-Defines the maximum copy range to userspace, for packets matching the
-rule. The default range is 0, which means the maximum copy range is
-given by
-.BR nlbufsiz .
-A maximum copy range larger than
-128*1024 is meaningless as the packets sent to userspace have an upper
-size limit of 128*1024.
-.TP
-.BR --ulog-qthreshold " \fIthreshold\fP"
-.br
-Queue at most
-.I threshold
-number of packets before sending them to
-userspace with a netlink socket. Note that packets can be sent to
-userspace before the queue is full, this happens when the ulog
-kernel timer goes off (the frequency of this timer depends on
-.BR flushtimeout ).
-.SS TARGET EXTENSIONS
-.SS arpreply
-The
-.B arpreply
-target can be used in the
-.BR PREROUTING " chain of the " nat " table."
-If this target sees an ARP request it will automatically reply
-with an ARP reply. The used MAC address for the reply can be specified.
-The protocol must be specified as
-.IR ARP .
-When the ARP message is not an ARP request or when the ARP request isn't
-for an IP address on an Ethernet network, it is ignored by this target
-.BR "" ( CONTINUE ).
-When the ARP request is malformed, it is dropped
-.BR "" ( DROP ).
-.TP
-.BR "--arpreply-mac " "\fIaddress\fP"
-Specifies the MAC address to reply with: the Ethernet source MAC and the
-ARP payload source MAC will be filled in with this address.
-.TP
-.BR "--arpreply-target " "\fItarget\fP"
-Specifies the standard target. After sending the ARP reply, the rule still
-has to give a standard target so ebtables knows what to do with the ARP request.
-The default target
-.BR "" "is " DROP .
-.SS dnat
-The
-.B dnat
-target can only be used in the
-.BR BROUTING " chain of the " broute " table and the "
-.BR PREROUTING " and " OUTPUT " chains of the " nat " table."
-It specifies that the destination MAC address has to be changed.
-.TP
-.BR "--to-destination " "\fIaddress\fP"
-.br
-Change the destination MAC address to the specified
-.IR address .
-The flag
-.B --to-dst
-is an alias for this option.
-.TP
-.BR "--dnat-target " "\fItarget\fP"
-.br
-Specifies the standard target. After doing the dnat, the rule still has to
-give a standard target so ebtables knows what to do with the dnated frame.
-The default target is
-.BR ACCEPT .
-Making it
-.BR CONTINUE " could let you use"
-multiple target extensions on the same frame. Making it
-.BR DROP " only makes"
-sense in the
-.BR BROUTING " chain but using the " redirect " target is more logical there. " RETURN " is also allowed. Note that using " RETURN
-in a base chain is not allowed (for obvious reasons).
-.SS mark
-.BR "" "The " mark " target can be used in every chain of every table. It is possible"
-to use the marking of a frame/packet in both ebtables and iptables,
-if the bridge-nf code is compiled into the kernel. Both put the marking at the
-same place. This allows for a form of communication between ebtables and iptables.
-.TP
-.BR "--mark-set " "\fIvalue\fP"
-.br
-Mark the frame with the specified non-negative
-.IR value .
-.TP
-.BR "--mark-or " "\fIvalue\fP"
-.br
-Or the frame with the specified non-negative
-.IR value .
-.TP
-.BR "--mark-and " "\fIvalue\fP"
-.br
-And the frame with the specified non-negative
-.IR value .
-.TP
-.BR "--mark-xor " "\fIvalue\fP"
-.br
-Xor the frame with the specified non-negative
-.IR value .
-.TP
-.BR "--mark-target " "\fItarget\fP"
-.br
-Specifies the standard target. After marking the frame, the rule
-still has to give a standard target so ebtables knows what to do.
-The default target is
-.BR ACCEPT ". Making it " CONTINUE " can let you do other"
-things with the frame in subsequent rules of the chain.
-.SS redirect
-The
-.B redirect
-target will change the MAC target address to that of the bridge device the
-frame arrived on. This target can only be used in the
-.BR BROUTING " chain of the " broute " table and the "
-.BR PREROUTING " chain of the " nat " table."
-In the
-.BR BROUTING " chain, the MAC address of the bridge port is used as destination address,"
-.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used."
-.TP
-.BR "--redirect-target " "\fItarget\fP"
-.br
-Specifies the standard target. After doing the MAC redirect, the rule
-still has to give a standard target so ebtables knows what to do.
-The default target is
-.BR ACCEPT ". Making it " CONTINUE " could let you use"
-multiple target extensions on the same frame. Making it
-.BR DROP " in the " BROUTING " chain will let the frames be routed. " RETURN " is also allowed. Note"
-.BR "" "that using " RETURN " in a base chain is not allowed."
-.SS snat
-The
-.B snat
-target can only be used in the
-.BR POSTROUTING " chain of the " nat " table."
-It specifies that the source MAC address has to be changed.
-.TP
-.BR "--to-source " "\fIaddress\fP"
-.br
-Changes the source MAC address to the specified
-.IR address ". The flag"
-.B --to-src
-is an alias for this option.
-.TP
-.BR "--snat-target " "\fItarget\fP"
-.br
-Specifies the standard target. After doing the snat, the rule still has 
-to give a standard target so ebtables knows what to do.
-.BR "" "The default target is " ACCEPT ". Making it " CONTINUE " could let you use"
-.BR "" "multiple target extensions on the same frame. Making it " DROP " doesn't"
-.BR "" "make sense, but you could do that too. " RETURN " is also allowed. Note"
-.BR "" "that using " RETURN " in a base chain is not allowed."
-.br
-.TP
-.BR "--snat-arp "
-.br
-Also change the hardware source address inside the arp header if the packet is an
-arp message and the hardware address length in the arp header is 6 bytes.
-.br
-.SH FILES
-.I /etc/ethertypes
-.I $(LOCKFILE)
-.SH ENVIRONMENT VARIABLES
-.I EBTABLES_ATOMIC_FILE
-.SH MAILINGLISTS
-.BR "" "See " http://netfilter.org/mailinglists.html
-.SH SEE ALSO
-.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8)
-.PP
-.BR "" "See " http://ebtables.sf.net