from small one page howto to huge articles all in one place
 

search text in:





Poll
Which linux distribution do you use?







poll results

Last additions:
using iotop to find disk usage hogs

using iotop to find disk usage hogs

words:

887

views:

101542

userrating:

average rating: 1.7 (84 votes) (1=very good 6=terrible)


May 25th. 2007:
Words

486

Views

216528

why adblockers are bad


Workaround and fixes for the current Core Dump Handling vulnerability affected kernels

Workaround and fixes for the current Core Dump Handling vulnerability affected kernels

words:

161

views:

97366

userrating:

average rating: 1.3 (28 votes) (1=very good 6=terrible)


April, 26th. 2006:

Druckversion
You are here: manpages





ematch

Section: Linux (8)
Updated: 6 August 2012
Index Return to Main Contents
 

NAME

ematch - extended matches for use with "basic" or "flow" filters  

SYNOPSIS

tc filter add .. basic match EXPR .. flowid ..

EXPR := TERM [ { and | or } EXPR ]

TERM := [ not ] { MATCH | '(' EXPR ')' }

MATCH := module '(' ARGS ')'

ARGS := ARG1 ARG2 ..

 

MATCHES

 

cmp

Simple comparison ematch: arithmetic compare of packet data to a given value.

cmp( ALIGN at OFFSET [ ATTRS ] { eq | lt | gt } VALUE )

ALIGN := { u8 | u16 | u32 }

ATTRS := [ layer LAYER ] [ mask MASK ] [ trans ]

LAYER := { link | network | transport | 0..2 }

 

meta

Metadata ematch

meta( OBJECT { eq | lt |gt } OBJECT )

OBJECT := { META_ID | VALUE }

META_ID := id [ shift SHIFT ] [ mask MASK ]

meta attributes:

random 32 bit random value

loadavg_1 Load average in last 5 minutes

nf_mark Netfilter mark

vlan Vlan tag

sk_rcvbuf Receive buffer size

sk_snd_queue Send queue length

A full list of meta attributes can be obtained via

# tc filter add dev eth1 basic match 'meta(list)'

 

nbyte

match packet data byte sequence

nbyte( NEEDLE at OFFSET [ layer LAYER ] )

NEEDLE := { string | c-escape-sequence }

OFFSET := int

LAYER := { link | network | transport | 0..2 }

 

u32

u32 ematch

u32( ALIGN VALUE MASK at [ nexthdr+ ] OFFSET )

ALIGN := { u8 | u16 | u32 }

 

ipset

test packet against ipset membership

ipset( SETNAME FLAGS )

SETNAME := string

FLAGS := { FLAG [, FLAGS] }

The flag options are the same as those used by the iptables "set" match.

When using the ipset ematch with the "ip_set_hash:net,iface" set type, the interface can be queried using "src,dst (source ip address, outgoing interface) or "src,src" (source ip address, incoming interface) syntax.

 

CAVEATS

The ematch syntax uses '(' and ')' to group expressions. All braces need to be escaped properly to prevent shell commandline from interpreting these directly.

When using the ipset ematch with the "ifb" device, the outgoing device will be the ifb device itself, e.g. "ifb0". The original interface (i.e. the device the packet arrived on) is treated as the incoming interface.

 

EXAMPLE & USAGE

# tc filter add .. basic match ...

# 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'

# 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'

# 'nbyte("ababa" at 12 layer 1)'

# 'u32(u16 0x1122 0xffff at nexthdr+4)'

Check if packet source ip address is member of set named bulk:

# 'ipset(bulk src)'

Check if packet source ip and the interface the packet arrived on is member of "hash:net,iface" set named interactive:

# 'ipset(interactive src,src)'

 

AUTHOR

The extended match infrastructure was added by Thomas Graf.


 

Index

NAME
SYNOPSIS
MATCHES
cmp
meta
nbyte
u32
ipset
CAVEATS
EXAMPLE & USAGE
AUTHOR


Please read "Why adblockers are bad".



Other free services
toURL.org
Shorten long
URLs to short
links like
http://tourl.org/2
tourl.org
.
Reverse DNS lookup
Find out which hostname(s)
resolve to a
given IP or other hostnames for the server
www.reversednslookup.org
rdf newsfeed | rss newsfeed | Atom newsfeed
- Powered by LeopardCMS - Running on Gentoo -
Copyright 2004-2017 Sascha Nitsch Unternehmensberatung UG(haftungsbeschränkt)
Valid XHTML1.1 : Valid CSS : buttonmaker
- Level Triple-A Conformance to Web Content Accessibility Guidelines 1.0 -
- Copyright and legal notices -
Time to create this page: 3.4 ms