| lh | 9ed821d | 2023-04-07 01:36:19 -0700 | [diff] [blame^] | 1 | # |
| 2 | # Location definitions for packet matching |
| 3 | # |
| 4 | |
| 5 | # name alignment offset mask shift |
| 6 | ip.version u8 net+0 0xF0 4 |
| 7 | ip.hdrlen u8 net+0 0x0F |
| 8 | ip.diffserv u8 net+1 |
| 9 | ip.length u16 net+2 |
| 10 | ip.id u16 net+4 |
| 11 | ip.flag.res u8 net+6 0xff 7 |
| 12 | ip.df u8 net+6 0x40 6 |
| 13 | ip.mf u8 net+6 0x20 5 |
| 14 | ip.offset u16 net+6 0x1FFF |
| 15 | ip.ttl u8 net+8 |
| 16 | ip.proto u8 net+9 |
| 17 | ip.chksum u16 net+10 |
| 18 | ip.src u32 net+12 |
| 19 | ip.dst u32 net+16 |
| 20 | |
| 21 | # if ip.ihl > 5 |
| 22 | ip.opts u32 net+20 |
| 23 | |
| 24 | |
| 25 | # |
| 26 | # IP version 6 |
| 27 | # |
| 28 | # name alignment offset mask shift |
| 29 | ip6.version u8 net+0 0xF0 4 |
| 30 | ip6.tc u16 net+0 0xFF0 4 |
| 31 | ip6.flowlabel u32 net+0 0xFFFFF |
| 32 | ip6.length u16 net+4 |
| 33 | ip6.nexthdr u8 net+6 |
| 34 | ip6.hoplimit u8 net+7 |
| 35 | ip6.src 16 net+8 |
| 36 | ip6.dst 16 net+24 |
| 37 | |
| 38 | # |
| 39 | # Transmission Control Protocol (TCP) |
| 40 | # |
| 41 | # name alignment offset mask shift |
| 42 | tcp.sport u16 tcp+0 |
| 43 | tcp.dport u16 tcp+2 |
| 44 | tcp.seq u32 tcp+4 |
| 45 | tcp.ack u32 tcp+8 |
| 46 | |
| 47 | # Data offset (4 bits) |
| 48 | tcp.off u8 tcp+12 0xF0 4 |
| 49 | |
| 50 | # Reserved [0 0 0] (3 bits) |
| 51 | tcp.reserved u8 tcp+12 0x04 1 |
| 52 | |
| 53 | # ECN [N C E] (3 bits) |
| 54 | tcp.ecn u16 tcp+12 0x01C00 6 |
| 55 | |
| 56 | # Individual TCP flags (0|1) (6 bits in total) |
| 57 | tcp.flag.urg u8 tcp+13 0x20 5 |
| 58 | tcp.flag.ack u8 tcp+13 0x10 4 |
| 59 | tcp.flag.psh u8 tcp+13 0x08 3 |
| 60 | tcp.flag.rst u8 tcp+13 0x04 2 |
| 61 | tpc.flag.syn u8 tcp+13 0x02 1 |
| 62 | tcp.flag.fin u8 tcp+13 0x01 |
| 63 | |
| 64 | tcp.win u16 tcp+14 |
| 65 | tcp.csum u16 tcp+16 |
| 66 | tcp.urg u16 tcp+18 |
| 67 | tcp.opts u32 tcp+20 |
| 68 | |
| 69 | # |
| 70 | # User Datagram Protocol (UDP) |
| 71 | # |
| 72 | # name alignment offset mask shift |
| 73 | udp.sport u16 tcp+0 |
| 74 | udp.dport u16 tcp+2 |
| 75 | udp.length u16 tcp+4 |
| 76 | udp.csum u16 tcp+6 |