|
Packit Service |
3880ab |
.TH "Flower filter in tc" 8 "22 Oct 2015" "iproute2" "Linux"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
"Usage: ct clear\n"
|
|
Packit Service |
3880ab |
" ct commit [force] [zone ZONE] [mark MASKED_MARK] [label MASKED_LABEL] [nat NAT_SPEC] [OFFLOAD_POLICY]\n"
|
|
Packit Service |
3880ab |
" ct [nat] [zone ZONE] [OFFLOAD_POLICY]\n"
|
|
Packit Service |
3880ab |
"Where: ZONE is the conntrack zone table number\n"
|
|
Packit Service |
3880ab |
" NAT_SPEC is {src|dst} addr addr1[-addr2] [port port1[-port2]]\n"
|
|
Packit Service |
3880ab |
" OFFLOAD_POLICY is [policy_pkts PACKETS] [policy_timeout TIMEOUT]\n"
|
|
Packit Service |
3880ab |
.SH NAME
|
|
Packit Service |
3880ab |
flower \- flow based traffic control filter
|
|
Packit Service |
3880ab |
.SH SYNOPSIS
|
|
Packit Service |
3880ab |
.in +8
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.BR tc " " filter " ... " flower " [ "
|
|
Packit Service |
3880ab |
.IR MATCH_LIST " ] [ "
|
|
Packit Service |
3880ab |
.B action
|
|
Packit Service |
3880ab |
.IR ACTION_SPEC " ] [ "
|
|
Packit Service |
3880ab |
.B classid
|
|
Packit Service |
3880ab |
.IR CLASSID " ] [ "
|
|
Packit Service |
3880ab |
.B hw_tc
|
|
Packit Service |
3880ab |
.IR TCID " ]"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR MATCH_LIST " := [ " MATCH_LIST " ] " MATCH
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR MATCH " := { "
|
|
Packit Service |
3880ab |
.B indev
|
|
Packit Service |
3880ab |
.IR ifname " | "
|
|
Packit Service |
3880ab |
.BR verbose
|
|
Packit Service |
3880ab |
.RI " | "
|
|
Packit Service |
3880ab |
.BR skip_sw " | " skip_hw
|
|
Packit Service |
3880ab |
.RI " | { "
|
|
Packit Service |
3880ab |
.BR dst_mac " | " src_mac " } "
|
|
Packit Service |
3880ab |
.IR MASKED_LLADDR " | "
|
|
Packit Service |
3880ab |
.B vlan_id
|
|
Packit Service |
3880ab |
.IR VID " | "
|
|
Packit Service |
3880ab |
.B vlan_prio
|
|
Packit Service |
3880ab |
.IR PRIORITY " | "
|
|
Packit Service |
3880ab |
.BR vlan_ethtype " { " ipv4 " | " ipv6 " | "
|
|
Packit Service |
3880ab |
.IR ETH_TYPE " } | "
|
|
Packit Service |
3880ab |
.B cvlan_id
|
|
Packit Service |
3880ab |
.IR VID " | "
|
|
Packit Service |
3880ab |
.B cvlan_prio
|
|
Packit Service |
3880ab |
.IR PRIORITY " | "
|
|
Packit Service |
3880ab |
.BR cvlan_ethtype " { " ipv4 " | " ipv6 " | "
|
|
Packit Service |
3880ab |
.IR ETH_TYPE " } | "
|
|
Packit Service |
3880ab |
.B mpls
|
|
Packit Service |
3880ab |
.IR LSE_LIST " | "
|
|
Packit Service |
3880ab |
.B mpls_label
|
|
Packit Service |
3880ab |
.IR LABEL " | "
|
|
Packit Service |
3880ab |
.B mpls_tc
|
|
Packit Service |
3880ab |
.IR TC " | "
|
|
Packit Service |
3880ab |
.B mpls_bos
|
|
Packit Service |
3880ab |
.IR BOS " | "
|
|
Packit Service |
3880ab |
.B mpls_ttl
|
|
Packit Service |
3880ab |
.IR TTL " | "
|
|
Packit Service |
3880ab |
.BR ip_proto " { " tcp " | " udp " | " sctp " | " icmp " | " icmpv6 " | "
|
|
Packit Service |
3880ab |
.IR IP_PROTO " } | "
|
|
Packit Service |
3880ab |
.B ip_tos
|
|
Packit Service |
3880ab |
.IR MASKED_IP_TOS " | "
|
|
Packit Service |
3880ab |
.B ip_ttl
|
|
Packit Service |
3880ab |
.IR MASKED_IP_TTL " | { "
|
|
Packit Service |
3880ab |
.BR dst_ip " | " src_ip " } "
|
|
Packit Service |
3880ab |
.IR PREFIX " | { "
|
|
Packit Service |
3880ab |
.BR dst_port " | " src_port " } { "
|
|
Packit Service |
3880ab |
.IR MASKED_NUMBER " | "
|
|
Packit Service |
3880ab |
.IR min_port_number-max_port_number " } | "
|
|
Packit Service |
3880ab |
.B tcp_flags
|
|
Packit Service |
3880ab |
.IR MASKED_TCP_FLAGS " | "
|
|
Packit Service |
3880ab |
.B type
|
|
Packit Service |
3880ab |
.IR MASKED_TYPE " | "
|
|
Packit Service |
3880ab |
.B code
|
|
Packit Service |
3880ab |
.IR MASKED_CODE " | { "
|
|
Packit Service |
3880ab |
.BR arp_tip " | " arp_sip " } "
|
|
Packit Service |
3880ab |
.IR IPV4_PREFIX " | "
|
|
Packit Service |
3880ab |
.BR arp_op " { " request " | " reply " | "
|
|
Packit Service |
3880ab |
.IR OP " } | { "
|
|
Packit Service |
3880ab |
.BR arp_tha " | " arp_sha " } "
|
|
Packit Service |
3880ab |
.IR MASKED_LLADDR " | "
|
|
Packit Service |
3880ab |
.B enc_key_id
|
|
Packit Service |
3880ab |
.IR KEY-ID " | {"
|
|
Packit Service |
3880ab |
.BR enc_dst_ip " | " enc_src_ip " } { "
|
|
Packit Service |
3880ab |
.IR ipv4_address " | " ipv6_address " } | "
|
|
Packit Service |
3880ab |
.B enc_dst_port
|
|
Packit Service |
3880ab |
.IR port_number " | "
|
|
Packit Service |
3880ab |
.B enc_tos
|
|
Packit Service |
3880ab |
.IR TOS " | "
|
|
Packit Service |
3880ab |
.B enc_ttl
|
|
Packit Service |
3880ab |
.IR TTL " | "
|
|
Packit Service |
3880ab |
{
|
|
Packit Service |
3880ab |
.B geneve_opts
|
|
Packit Service |
3880ab |
|
|
|
Packit Service |
3880ab |
.B vxlan_opts
|
|
Packit Service |
3880ab |
|
|
|
Packit Service |
3880ab |
.B erspan_opts
|
|
Packit Service |
3880ab |
}
|
|
Packit Service |
3880ab |
.IR OPTIONS " | "
|
|
Packit Service |
3880ab |
.BR ip_flags
|
|
Packit Service |
3880ab |
.IR IP_FLAGS " }"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR LSE_LIST " := [ " LSE_LIST " ] " LSE
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR LSE " := "
|
|
Packit Service |
3880ab |
.B lse depth
|
|
Packit Service |
3880ab |
.IR DEPTH " { "
|
|
Packit Service |
3880ab |
.B label
|
|
Packit Service |
3880ab |
.IR LABEL " | "
|
|
Packit Service |
3880ab |
.B tc
|
|
Packit Service |
3880ab |
.IR TC " | "
|
|
Packit Service |
3880ab |
.B bos
|
|
Packit Service |
3880ab |
.IR BOS " | "
|
|
Packit Service |
3880ab |
.B ttl
|
|
Packit Service |
3880ab |
.IR TTL " }"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.SH DESCRIPTION
|
|
Packit Service |
3880ab |
The
|
|
Packit Service |
3880ab |
.B flower
|
|
Packit Service |
3880ab |
filter matches flows to the set of keys specified and assigns an arbitrarily
|
|
Packit Service |
3880ab |
chosen class ID to packets belonging to them. Additionally (or alternatively) an
|
|
Packit Service |
3880ab |
action from the generic action framework may be called.
|
|
Packit Service |
3880ab |
.SH OPTIONS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI action " ACTION_SPEC"
|
|
Packit Service |
3880ab |
Apply an action from the generic actions framework on matching packets.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI classid " CLASSID"
|
|
Packit Service |
3880ab |
Specify a class to pass matching packets on to.
|
|
Packit Service |
3880ab |
.I CLASSID
|
|
Packit Service |
3880ab |
is in the form
|
|
Packit Service |
3880ab |
.BR X : Y ", while " X " and " Y
|
|
Packit Service |
3880ab |
are interpreted as numbers in hexadecimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI hw_tc " TCID"
|
|
Packit Service |
3880ab |
Specify a hardware traffic class to pass matching packets on to. TCID is in the
|
|
Packit Service |
3880ab |
range 0 through 15.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI indev " ifname"
|
|
Packit Service |
3880ab |
Match on incoming interface name. Obviously this makes sense only for forwarded
|
|
Packit Service |
3880ab |
flows.
|
|
Packit Service |
3880ab |
.I ifname
|
|
Packit Service |
3880ab |
is the name of an interface which must exist at the time of
|
|
Packit Service |
3880ab |
.B tc
|
|
Packit Service |
3880ab |
invocation.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI verbose
|
|
Packit Service |
3880ab |
Enable verbose logging, including offloading errors when not using
|
|
Packit Service |
3880ab |
.B skip_sw
|
|
Packit Service |
3880ab |
flag.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI skip_sw
|
|
Packit Service |
3880ab |
Do not process filter by software. If hardware has no offload support for this
|
|
Packit Service |
3880ab |
filter, or TC offload is not enabled for the interface, operation will fail.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI skip_hw
|
|
Packit Service |
3880ab |
Do not process filter by hardware.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI dst_mac " MASKED_LLADDR"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI src_mac " MASKED_LLADDR"
|
|
Packit Service |
3880ab |
Match on source or destination MAC address. A mask may be optionally
|
|
Packit Service |
3880ab |
provided to limit the bits of the address which are matched. A mask is
|
|
Packit Service |
3880ab |
provided by following the address with a slash and then the mask. It may be
|
|
Packit Service |
3880ab |
provided in LLADDR format, in which case it is a bitwise mask, or as a
|
|
Packit Service |
3880ab |
number of high bits to match. If the mask is missing then a match on all
|
|
Packit Service |
3880ab |
bits is assumed.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI vlan_id " VID"
|
|
Packit Service |
3880ab |
Match on vlan tag id.
|
|
Packit Service |
3880ab |
.I VID
|
|
Packit Service |
3880ab |
is an unsigned 12bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI vlan_prio " PRIORITY"
|
|
Packit Service |
3880ab |
Match on vlan tag priority.
|
|
Packit Service |
3880ab |
.I PRIORITY
|
|
Packit Service |
3880ab |
is an unsigned 3bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI vlan_ethtype " VLAN_ETH_TYPE"
|
|
Packit Service |
3880ab |
Match on layer three protocol.
|
|
Packit Service |
3880ab |
.I VLAN_ETH_TYPE
|
|
Packit Service |
3880ab |
may be either
|
|
Packit Service |
3880ab |
.BR ipv4 ", " ipv6
|
|
Packit Service |
3880ab |
or an unsigned 16bit value in hexadecimal format. To match on QinQ packet, it must be 802.1Q or 802.1AD.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI cvlan_id " VID"
|
|
Packit Service |
3880ab |
Match on QinQ inner vlan tag id.
|
|
Packit Service |
3880ab |
.I VID
|
|
Packit Service |
3880ab |
is an unsigned 12bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI cvlan_prio " PRIORITY"
|
|
Packit Service |
3880ab |
Match on QinQ inner vlan tag priority.
|
|
Packit Service |
3880ab |
.I PRIORITY
|
|
Packit Service |
3880ab |
is an unsigned 3bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI cvlan_ethtype " VLAN_ETH_TYPE"
|
|
Packit Service |
3880ab |
Match on QinQ layer three protocol.
|
|
Packit Service |
3880ab |
.I VLAN_ETH_TYPE
|
|
Packit Service |
3880ab |
may be either
|
|
Packit Service |
3880ab |
.BR ipv4 ", " ipv6
|
|
Packit Service |
3880ab |
or an unsigned 16bit value in hexadecimal format.
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI mpls " LSE_LIST"
|
|
Packit Service |
3880ab |
Match on the MPLS label stack.
|
|
Packit Service |
3880ab |
.I LSE_LIST
|
|
Packit Service |
3880ab |
is a list of Label Stack Entries, each introduced by the
|
|
Packit Service |
3880ab |
.BR lse " keyword."
|
|
Packit Service |
3880ab |
This option can't be used together with the standalone
|
|
Packit Service |
3880ab |
.BR mpls_label ", " mpls_tc ", " mpls_bos " and " mpls_ttl " options."
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI lse " LSE_OPTIONS"
|
|
Packit Service |
3880ab |
Match on an MPLS Label Stack Entry.
|
|
Packit Service |
3880ab |
.I LSE_OPTIONS
|
|
Packit Service |
3880ab |
is a list of options that describe the properties of the LSE to match.
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI depth " DEPTH"
|
|
Packit Service |
3880ab |
The depth of the Label Stack Entry to consider. Depth starts at 1 (the
|
|
Packit Service |
3880ab |
outermost Label Stack Entry). The maximum usable depth may be limited by the
|
|
Packit Service |
3880ab |
kernel. This option is mandatory.
|
|
Packit Service |
3880ab |
.I DEPTH
|
|
Packit Service |
3880ab |
is an unsigned 8 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI label " LABEL"
|
|
Packit Service |
3880ab |
Match on the MPLS Label field at the specified
|
|
Packit Service |
3880ab |
.BR depth .
|
|
Packit Service |
3880ab |
.I LABEL
|
|
Packit Service |
3880ab |
is an unsigned 20 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI tc " TC"
|
|
Packit Service |
3880ab |
Match on the MPLS Traffic Class field at the specified
|
|
Packit Service |
3880ab |
.BR depth .
|
|
Packit Service |
3880ab |
.I TC
|
|
Packit Service |
3880ab |
is an unsigned 3 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI bos " BOS"
|
|
Packit Service |
3880ab |
Match on the MPLS Bottom Of Stack field at the specified
|
|
Packit Service |
3880ab |
.BR depth .
|
|
Packit Service |
3880ab |
.I BOS
|
|
Packit Service |
3880ab |
is a 1 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI ttl " TTL"
|
|
Packit Service |
3880ab |
Match on the MPLS Time To Live field at the specified
|
|
Packit Service |
3880ab |
.BR depth .
|
|
Packit Service |
3880ab |
.I TTL
|
|
Packit Service |
3880ab |
is an unsigned 8 bit value in decimal format.
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI mpls_label " LABEL"
|
|
Packit Service |
3880ab |
Match the label id in the outermost MPLS label stack entry.
|
|
Packit Service |
3880ab |
.I LABEL
|
|
Packit Service |
3880ab |
is an unsigned 20 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI mpls_tc " TC"
|
|
Packit Service |
3880ab |
Match on the MPLS TC field, which is typically used for packet priority,
|
|
Packit Service |
3880ab |
in the outermost MPLS label stack entry.
|
|
Packit Service |
3880ab |
.I TC
|
|
Packit Service |
3880ab |
is an unsigned 3 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI mpls_bos " BOS"
|
|
Packit Service |
3880ab |
Match on the MPLS Bottom Of Stack field in the outermost MPLS label stack
|
|
Packit Service |
3880ab |
entry.
|
|
Packit Service |
3880ab |
.I BOS
|
|
Packit Service |
3880ab |
is a 1 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI mpls_ttl " TTL"
|
|
Packit Service |
3880ab |
Match on the MPLS Time To Live field in the outermost MPLS label stack
|
|
Packit Service |
3880ab |
entry.
|
|
Packit Service |
3880ab |
.I TTL
|
|
Packit Service |
3880ab |
is an unsigned 8 bit value in decimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI ip_proto " IP_PROTO"
|
|
Packit Service |
3880ab |
Match on layer four protocol.
|
|
Packit Service |
3880ab |
.I IP_PROTO
|
|
Packit Service |
3880ab |
may be
|
|
Packit Service |
3880ab |
.BR tcp ", " udp ", " sctp ", " icmp ", " icmpv6
|
|
Packit Service |
3880ab |
or an unsigned 8bit value in hexadecimal format.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI ip_tos " MASKED_IP_TOS"
|
|
Packit Service |
3880ab |
Match on ipv4 TOS or ipv6 traffic-class - eight bits in hexadecimal format.
|
|
Packit Service |
3880ab |
A mask may be optionally provided to limit the bits which are matched. A mask
|
|
Packit Service |
3880ab |
is provided by following the value with a slash and then the mask. If the mask
|
|
Packit Service |
3880ab |
is missing then a match on all bits is assumed.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI ip_ttl " MASKED_IP_TTL"
|
|
Packit Service |
3880ab |
Match on ipv4 TTL or ipv6 hop-limit - eight bits value in decimal or hexadecimal format.
|
|
Packit Service |
3880ab |
A mask may be optionally provided to limit the bits which are matched. Same
|
|
Packit Service |
3880ab |
logic is used for the mask as with matching on ip_tos.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI dst_ip " PREFIX"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI src_ip " PREFIX"
|
|
Packit Service |
3880ab |
Match on source or destination IP address.
|
|
Packit Service |
3880ab |
.I PREFIX
|
|
Packit Service |
3880ab |
must be a valid IPv4 or IPv6 address, depending on the \fBprotocol\fR
|
|
Packit Service |
3880ab |
option to tc filter, optionally followed by a slash and the prefix length.
|
|
Packit Service |
3880ab |
If the prefix is missing, \fBtc\fR assumes a full-length host match.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.IR \fBdst_port " { " MASKED_NUMBER " | " " MIN_VALUE-MAX_VALUE " }
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.IR \fBsrc_port " { " MASKED_NUMBER " | " " MIN_VALUE-MAX_VALUE " }
|
|
Packit Service |
3880ab |
Match on layer 4 protocol source or destination port number, with an
|
|
Packit Service |
3880ab |
optional mask. Alternatively, the mininum and maximum values can be
|
|
Packit Service |
3880ab |
specified to match on a range of layer 4 protocol source or destination
|
|
Packit Service |
3880ab |
port numbers. Only available for
|
|
Packit Service |
3880ab |
.BR ip_proto " values " udp ", " tcp " and " sctp
|
|
Packit Service |
3880ab |
which have to be specified in beforehand.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI tcp_flags " MASKED_TCP_FLAGS"
|
|
Packit Service |
3880ab |
Match on TCP flags represented as 12bit bitfield in in hexadecimal format.
|
|
Packit Service |
3880ab |
A mask may be optionally provided to limit the bits which are matched. A mask
|
|
Packit Service |
3880ab |
is provided by following the value with a slash and then the mask. If the mask
|
|
Packit Service |
3880ab |
is missing then a match on all bits is assumed.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI type " MASKED_TYPE"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI code " MASKED_CODE"
|
|
Packit Service |
3880ab |
Match on ICMP type or code. A mask may be optionally provided to limit the
|
|
Packit Service |
3880ab |
bits of the address which are matched. A mask is provided by following the
|
|
Packit Service |
3880ab |
address with a slash and then the mask. The mask must be as a number which
|
|
Packit Service |
3880ab |
represents a bitwise mask If the mask is missing then a match on all bits
|
|
Packit Service |
3880ab |
is assumed. Only available for
|
|
Packit Service |
3880ab |
.BR ip_proto " values " icmp " and " icmpv6
|
|
Packit Service |
3880ab |
which have to be specified in beforehand.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI arp_tip " IPV4_PREFIX"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI arp_sip " IPV4_PREFIX"
|
|
Packit Service |
3880ab |
Match on ARP or RARP sender or target IP address.
|
|
Packit Service |
3880ab |
.I IPV4_PREFIX
|
|
Packit Service |
3880ab |
must be a valid IPv4 address optionally followed by a slash and the prefix
|
|
Packit Service |
3880ab |
length. If the prefix is missing, \fBtc\fR assumes a full-length host
|
|
Packit Service |
3880ab |
match.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI arp_op " ARP_OP"
|
|
Packit Service |
3880ab |
Match on ARP or RARP operation.
|
|
Packit Service |
3880ab |
.I ARP_OP
|
|
Packit Service |
3880ab |
may be
|
|
Packit Service |
3880ab |
.BR request ", " reply
|
|
Packit Service |
3880ab |
or an integer value 0, 1 or 2. A mask may be optionally provided to limit
|
|
Packit Service |
3880ab |
the bits of the operation which are matched. A mask is provided by
|
|
Packit Service |
3880ab |
following the address with a slash and then the mask. It may be provided as
|
|
Packit Service |
3880ab |
an unsigned 8 bit value representing a bitwise mask. If the mask is missing
|
|
Packit Service |
3880ab |
then a match on all bits is assumed.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI arp_sha " MASKED_LLADDR"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI arp_tha " MASKED_LLADDR"
|
|
Packit Service |
3880ab |
Match on ARP or RARP sender or target MAC address. A mask may be optionally
|
|
Packit Service |
3880ab |
provided to limit the bits of the address which are matched. A mask is
|
|
Packit Service |
3880ab |
provided by following the address with a slash and then the mask. It may be
|
|
Packit Service |
3880ab |
provided in LLADDR format, in which case it is a bitwise mask, or as a
|
|
Packit Service |
3880ab |
number of high bits to match. If the mask is missing then a match on all
|
|
Packit Service |
3880ab |
bits is assumed.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI enc_key_id " NUMBER"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI enc_dst_ip " PREFIX"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI enc_src_ip " PREFIX"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI enc_dst_port " NUMBER"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI enc_tos " NUMBER"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI enc_ttl " NUMBER"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BR
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI ct_state " CT_STATE"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI ct_zone " CT_MASKED_ZONE"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI ct_mark " CT_MASKED_MARK"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI ct_label " CT_MASKED_LABEL"
|
|
Packit Service |
3880ab |
Matches on connection tracking info
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.I CT_STATE
|
|
Packit Service |
3880ab |
Match the connection state, and can ne combination of [{+|-}flag] flags, where flag can be one of
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
trk - Tracked connection.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
new - New connection.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
est - Established connection.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
Example: +trk+est
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.I CT_MASKED_ZONE
|
|
Packit Service |
3880ab |
Match the connection zone, and can be masked.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.I CT_MASKED_MARK
|
|
Packit Service |
3880ab |
32bit match on the connection mark, and can be masked.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.I CT_MASKED_LABEL
|
|
Packit Service |
3880ab |
128bit match on the connection label, and can be masked.
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI geneve_opts " OPTIONS"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI vxlan_opts " OPTIONS"
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.BI erspan_opts " OPTIONS"
|
|
Packit Service |
3880ab |
Match on IP tunnel metadata. Key id
|
|
Packit Service |
3880ab |
.I NUMBER
|
|
Packit Service |
3880ab |
is a 32 bit tunnel key id (e.g. VNI for VXLAN tunnel).
|
|
Packit Service |
3880ab |
.I PREFIX
|
|
Packit Service |
3880ab |
must be a valid IPv4 or IPv6 address optionally followed by a slash and the
|
|
Packit Service |
3880ab |
prefix length. If the prefix is missing, \fBtc\fR assumes a full-length
|
|
Packit Service |
3880ab |
host match. Dst port
|
|
Packit Service |
3880ab |
.I NUMBER
|
|
Packit Service |
3880ab |
is a 16 bit UDP dst port. Tos
|
|
Packit Service |
3880ab |
.I NUMBER
|
|
Packit Service |
3880ab |
is an 8 bit tos (dscp+ecn) value, ttl
|
|
Packit Service |
3880ab |
.I NUMBER
|
|
Packit Service |
3880ab |
is an 8 bit time-to-live value. geneve_opts
|
|
Packit Service |
3880ab |
.I OPTIONS
|
|
Packit Service |
3880ab |
must be a valid list of comma-separated geneve options where each option
|
|
Packit Service |
3880ab |
consists of a key optionally followed by a slash and corresponding mask. If
|
|
Packit Service |
3880ab |
the masks is missing, \fBtc\fR assumes a full-length match. The options can
|
|
Packit Service |
3880ab |
be described in the form CLASS:TYPE:DATA/CLASS_MASK:TYPE_MASK:DATA_MASK,
|
|
Packit Service |
3880ab |
where CLASS is represented as a 16bit hexadecimal value, TYPE as an 8bit
|
|
Packit Service |
3880ab |
hexadecimal value and DATA as a variable length hexadecimal value.
|
|
Packit Service |
3880ab |
vxlan_opts
|
|
Packit Service |
3880ab |
.I OPTIONS
|
|
Packit Service |
3880ab |
doesn't support multiple options, and it consists of a key followed by a slash
|
|
Packit Service |
3880ab |
and corresponding mask. If the mask is missing, \fBtc\fR assumes a full-length
|
|
Packit Service |
3880ab |
match. The option can be described in the form GBP/GBP_MASK, where GBP is
|
|
Packit Service |
3880ab |
represented as a 32bit number.
|
|
Packit Service |
3880ab |
erspan_opts
|
|
Packit Service |
3880ab |
.I OPTIONS
|
|
Packit Service |
3880ab |
doesn't support multiple options, and it consists of a key followed by a slash
|
|
Packit Service |
3880ab |
and corresponding mask. If the mask is missing, \fBtc\fR assumes a full-length
|
|
Packit Service |
3880ab |
match. The option can be described in the form
|
|
Packit Service |
3880ab |
VERSION:INDEX:DIR:HWID/VERSION:INDEX_MASK:DIR_MASK:HWID_MASK, where VERSION is
|
|
Packit Service |
3880ab |
represented as a 8bit number, INDEX as an 32bit number, DIR and HWID as a 8bit
|
|
Packit Service |
3880ab |
number. Multiple options is not supported. Note INDEX/INDEX_MASK is used when
|
|
Packit Service |
3880ab |
VERSION is 1, and DIR/DIR_MASK and HWID/HWID_MASK are used when VERSION is 2.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI ip_flags " IP_FLAGS"
|
|
Packit Service |
3880ab |
.I IP_FLAGS
|
|
Packit Service |
3880ab |
may be either
|
|
Packit Service |
3880ab |
.BR frag ", " nofrag ", " firstfrag " or " nofirstfrag
|
|
Packit Service |
3880ab |
where frag and nofrag could be used to match on fragmented packets or not,
|
|
Packit Service |
3880ab |
respectively. firstfrag and nofirstfrag can be used to further distinguish
|
|
Packit Service |
3880ab |
fragmented packet. firstfrag can be used to indicate the first fragmented
|
|
Packit Service |
3880ab |
packet. nofirstfrag can be used to indicates subsequent fragmented packets
|
|
Packit Service |
3880ab |
or non-fragmented packets.
|
|
Packit Service |
3880ab |
.SH NOTES
|
|
Packit Service |
3880ab |
As stated above where applicable, matches of a certain layer implicitly depend
|
|
Packit Service |
3880ab |
on the matches of the next lower layer. Precisely, layer one and two matches
|
|
Packit Service |
3880ab |
(\fBindev\fR, \fBdst_mac\fR and \fBsrc_mac\fR)
|
|
Packit Service |
3880ab |
have no dependency,
|
|
Packit Service |
3880ab |
MPLS and layer three matches
|
|
Packit Service |
3880ab |
(\fBmpls\fR, \fBmpls_label\fR, \fBmpls_tc\fR, \fBmpls_bos\fR, \fBmpls_ttl\fR,
|
|
Packit Service |
3880ab |
\fBip_proto\fR, \fBdst_ip\fR, \fBsrc_ip\fR, \fBarp_tip\fR, \fBarp_sip\fR,
|
|
Packit Service |
3880ab |
\fBarp_op\fR, \fBarp_tha\fR, \fBarp_sha\fR and \fBip_flags\fR)
|
|
Packit Service |
3880ab |
depend on the
|
|
Packit Service |
3880ab |
.B protocol
|
|
Packit Service |
3880ab |
option of tc filter, layer four port matches
|
|
Packit Service |
3880ab |
(\fBdst_port\fR and \fBsrc_port\fR)
|
|
Packit Service |
3880ab |
depend on
|
|
Packit Service |
3880ab |
.B ip_proto
|
|
Packit Service |
3880ab |
being set to
|
|
Packit Service |
3880ab |
.BR tcp ", " udp " or " sctp,
|
|
Packit Service |
3880ab |
and finally ICMP matches (\fBcode\fR and \fBtype\fR) depend on
|
|
Packit Service |
3880ab |
.B ip_proto
|
|
Packit Service |
3880ab |
being set to
|
|
Packit Service |
3880ab |
.BR icmp " or " icmpv6.
|
|
Packit Service |
3880ab |
.P
|
|
Packit Service |
3880ab |
There can be only used one mask per one prio. If user needs to specify different
|
|
Packit Service |
3880ab |
mask, he has to use different prio.
|
|
Packit Service |
3880ab |
.SH SEE ALSO
|
|
Packit Service |
3880ab |
.BR tc (8),
|
|
Packit Service |
3880ab |
.BR tc-flow (8)
|