Product Info

Infinet Wireless: Technical Documentation – InfiMAN Evolution
Operation & Administration – 123
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Primitives Description
expr relop expr True if the relation holds, where relop is one of >, <, >=, <=, =, !=, and
expr is an arithmetic expression composed of integer constants
(expressed in standard C syntax), the normal binary operators [+, -, *, /,
&, |, <<, >>], a length operator, and special packet data accessors
Note that all comparisons are unsigned, so that, for example,
0x80000000 and 0xffffffff are > 0
To access data inside the packet, use the following syntax: “proto
[ expr : size ]”
Proto is one of ether, fddi, tr, wlan, ppp, slip, link, ip, arp, rarp, tcp, udp,
icmp, and indicates the protocol layer for the index operation (ether,
fddi, wlan, tr, ppp, slip and link all refer to the link layer)
tcp, udp and other upper-layer protocol types only apply to IPv4
The byte offset, relative to the indicated protocol layer, is given by expr
Size is optional and indicates the number of bytes in the field of
interest; it can be one, two, or four, and defaults to one
The length operator, indicated by the keyword len, gives the length of
the packet
For example, “ether[0] & 1 != 0” catches all multicast traffic
The expression “ip[0] & 0xf != 5” catches all IPv4 packets with options
The expression “ip[6:2] & 0x1fff = 0” catches only unfragmented IPv4
datagrams and frag zero of fragmented IPv4 datagrams
This check is implicitly applied to the "tcp" and "udp" index operations
For instance, "tcp[0]" always means the first byte of the TCP header,
and never means the first byte of an intervening fragment
Some offsets and field values may be expressed as names rather than
as numeric values
The following protocol header field offsets are available: icmptype
(ICMP type field), icmpcode (ICMP code field), and tcpflags (TCP flags
field)
The following ICMP type field values are available: icmp-echoreply,
icmp-unreach, icmp-sourcequench, icmp-redirect, icmp-echo, icmp-
routeradvert, icmp-routersolicit, icmp-timxceed, icmp-paramprob,
icmp-tstamp, icmp-tstampreply, icmp-ireq, icmp-ireqreply, icmp-
maskreq, icmp-maskreply
The following TCP flags field values are available: tcp-fin, tcp-syn, tcp-
rst, tcp-push, tcp-ack, tcp-urg
19 Table - Primitives
Primitives may be combined using:
A parenthesized group of primitives and operators (parentheses are special to the Shell and must be
escaped)
Negation (`!' or `not')
Concatenation (`&&' or `and')
Alternation (`||' or `or').
Negation has highest precedence. Alternation and concatenation have equal precedence and associate left to right.
Note that explicit and tokens, not juxtaposition, are now required for concatenation. If an identifier is given without
a keyword, the most recent keyword is assumed. For example, “not host 1.1.1.1 and 2.2.2.2” is short for “not host
1.1.1.1 and host 2.2.2.2” and should not be confused with “not (host 1.1.1.1 or 2.2.2.2)”.