# tcp option eol exists [ { "match": { "left": { "tcp option": { "name": "eol" } }, "op": "==", "right": true } } ] # tcp option nop exists [ { "match": { "left": { "tcp option": { "name": "nop" } }, "op": "==", "right": true } } ] # tcp option maxseg exists [ { "match": { "left": { "tcp option": { "name": "maxseg" } }, "op": "==", "right": true } } ] # tcp option maxseg length 1 [ { "match": { "left": { "tcp option": { "field": "length", "name": "maxseg" } }, "op": "==", "right": 1 } } ] # tcp option maxseg size 1 [ { "match": { "left": { "tcp option": { "field": "size", "name": "maxseg" } }, "op": "==", "right": 1 } } ] # tcp option window length 1 [ { "match": { "left": { "tcp option": { "field": "length", "name": "window" } }, "op": "==", "right": 1 } } ] # tcp option window count 1 [ { "match": { "left": { "tcp option": { "field": "count", "name": "window" } }, "op": "==", "right": 1 } } ] # tcp option sack-perm exists [ { "match": { "left": { "tcp option": { "name": "sack-perm" } }, "op": "==", "right": true } } ] # tcp option sack-perm length 1 [ { "match": { "left": { "tcp option": { "field": "length", "name": "sack-perm" } }, "op": "==", "right": 1 } } ] # tcp option sack exists [ { "match": { "left": { "tcp option": { "name": "sack" } }, "op": "==", "right": true } } ] # tcp option sack length 1 [ { "match": { "left": { "tcp option": { "field": "length", "name": "sack" } }, "op": "==", "right": 1 } } ] # tcp option sack left 1 [ { "match": { "left": { "tcp option": { "field": "left", "name": "sack" } }, "op": "==", "right": 1 } } ] # tcp option sack0 left 1 [ { "match": { "left": { "tcp option": { "field": "left", "name": "sack0" } }, "op": "==", "right": 1 } } ] # tcp option sack1 left 1 [ { "match": { "left": { "tcp option": { "field": "left", "name": "sack1" } }, "op": "==", "right": 1 } } ] # tcp option sack2 left 1 [ { "match": { "left": { "tcp option": { "field": "left", "name": "sack2" } }, "op": "==", "right": 1 } } ] # tcp option sack3 left 1 [ { "match": { "left": { "tcp option": { "field": "left", "name": "sack3" } }, "op": "==", "right": 1 } } ] # tcp option sack right 1 [ { "match": { "left": { "tcp option": { "field": "right", "name": "sack" } }, "op": "==", "right": 1 } } ] # tcp option sack0 right 1 [ { "match": { "left": { "tcp option": { "field": "right", "name": "sack0" } }, "op": "==", "right": 1 } } ] # tcp option sack1 right 1 [ { "match": { "left": { "tcp option": { "field": "right", "name": "sack1" } }, "op": "==", "right": 1 } } ] # tcp option sack2 right 1 [ { "match": { "left": { "tcp option": { "field": "right", "name": "sack2" } }, "op": "==", "right": 1 } } ] # tcp option sack3 right 1 [ { "match": { "left": { "tcp option": { "field": "right", "name": "sack3" } }, "op": "==", "right": 1 } } ] # tcp option timestamp exists [ { "match": { "left": { "tcp option": { "name": "timestamp" } }, "op": "==", "right": true } } ] # tcp option timestamp length 1 [ { "match": { "left": { "tcp option": { "field": "length", "name": "timestamp" } }, "op": "==", "right": 1 } } ] # tcp option timestamp tsval 1 [ { "match": { "left": { "tcp option": { "field": "tsval", "name": "timestamp" } }, "op": "==", "right": 1 } } ] # tcp option timestamp tsecr 1 [ { "match": { "left": { "tcp option": { "field": "tsecr", "name": "timestamp" } }, "op": "==", "right": 1 } } ] # tcp option 255 missing [ { "match": { "left": { "tcp option": { "base": 255, "len": 8, "offset": 0 } }, "op": "==", "right": false } } ] # tcp option 6 exists [ { "match": { "left": { "tcp option": { "base": 6, "len": 8, "offset": 0 } }, "op": "==", "right": true } } ] # tcp option @255,8,8 255 [ { "match": { "left": { "tcp option": { "base": 255, "len": 8, "offset": 8 } }, "op": "==", "right": 255 } } ] # tcp option window exists [ { "match": { "left": { "tcp option": { "name": "window" } }, "op": "==", "right": true } } ] # tcp option window missing [ { "match": { "left": { "tcp option": { "name": "window" } }, "op": "==", "right": false } } ] # tcp option maxseg size set 1360 [ { "mangle": { "key": { "tcp option": { "field": "size", "name": "maxseg" } }, "value": 1360 } } ] # tcp option md5sig exists [ { "match": { "left": { "tcp option": { "name": "md5sig" } }, "op": "==", "right": true } } ] # tcp option fastopen exists [ { "match": { "left": { "tcp option": { "name": "fastopen" } }, "op": "==", "right": true } } ] # tcp option mptcp exists [ { "match": { "left": { "tcp option": { "name": "mptcp" } }, "op": "==", "right": true } } ] # tcp option mptcp subtype 0 [ { "match": { "left": { "tcp option": { "field": "subtype", "name": "mptcp" } }, "op": "==", "right": 0 } } ] # tcp option mptcp subtype 1 [ { "match": { "left": { "tcp option": { "field": "subtype", "name": "mptcp" } }, "op": "==", "right": 1 } } ] # tcp option mptcp subtype { 0, 2} [ { "match": { "left": { "tcp option": { "field": "subtype", "name": "mptcp" } }, "op": "==", "right": { "set": [ 0, 2 ] } } } ] # reset tcp option mptcp [ { "reset": { "tcp option": { "name": "mptcp" } } } ] # reset tcp option 2 [ { "reset": { "tcp option": { "name": "maxseg" } } } ] # reset tcp option 123 [ { "reset": { "tcp option": { "base": 123, "len": 0, "offset": 0 } } } ]