# meta nfproto ipv4 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } } ] # meta nfproto ipv6 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv6" } } ] # meta nfproto {ipv4, ipv6} [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": { "set": [ "ipv4", "ipv6" ] } } } ] # meta nfproto != {ipv4, ipv6} [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "!=", "right": { "set": [ "ipv4", "ipv6" ] } } } ] # meta nfproto ipv6 tcp dport 22 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv6" } }, { "match": { "left": { "payload": { "field": "dport", "protocol": "tcp" } }, "op": "==", "right": 22 } } ] # meta nfproto ipv4 tcp dport 22 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } }, { "match": { "left": { "payload": { "field": "dport", "protocol": "tcp" } }, "op": "==", "right": 22 } } ] # meta nfproto ipv4 ip saddr 1.2.3.4 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } }, { "match": { "left": { "payload": { "field": "saddr", "protocol": "ip" } }, "op": "==", "right": "1.2.3.4" } } ] # meta nfproto ipv6 meta l4proto tcp [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv6" } }, { "match": { "left": { "meta": { "key": "l4proto" } }, "op": "==", "right": "tcp" } } ] # meta nfproto ipv4 counter ip saddr 1.2.3.4 [ { "match": { "left": { "meta": { "key": "nfproto" } }, "op": "==", "right": "ipv4" } }, { "counter": null }, { "match": { "left": { "payload": { "field": "saddr", "protocol": "ip" } }, "op": "==", "right": "1.2.3.4" } } ] # meta secpath exists [ { "match": { "left": { "meta": { "key": "secpath" } }, "op": "==", "right": true } } ] # meta secpath missing [ { "match": { "left": { "meta": { "key": "secpath" } }, "op": "==", "right": false } } ]