# meta nfproto ipv4 ip saddr 1.2.3.4 [ { "match": { "left": { "payload": { "field": "saddr", "protocol": "ip" } }, "op": "==", "right": "1.2.3.4" } } ] # meta nfproto ipv6 meta l4proto tcp [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv6" } }, { "match": { "left": { "meta": { "key": "l4proto" } }, "op": "==", "right": 6 } } ] # meta secpath missing [ { "match": { "left": { "meta": { "key": "ipsec" } }, "op": "==", "right": false } } ]