# comp nexthdr != esp
[
{
"match": {
"left": {
"payload": {
"field": "nexthdr",
"protocol": "comp"
}
},
"op": "!=",
"right": "esp"
}
}
]
# comp flags 0x0
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": "0x0"
}
}
]
# comp flags != 0x23
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": "0x23"
}
}
]
# comp flags 0x33-0x45
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": {
"range": [ "0x33", "0x45" ]
}
}
}
]
# comp flags != 0x33-0x45
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"range": [ "0x33", "0x45" ]
}
}
}
]
# comp flags {0x33, 0x55, 0x67, 0x88}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": {
"set": [
"0x33",
"0x55",
"0x67",
"0x88"
]
}
}
}
]
# comp flags != {0x33, 0x55, 0x67, 0x88}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"set": [
"0x33",
"0x55",
"0x67",
"0x88"
]
}
}
}
]
# comp flags { 0x33-0x55}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": {
"set": [
{ "range": [ "0x33", "0x55" ] }
]
}
}
}
]
# comp flags != { 0x33-0x55}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"set": [
{ "range": [ "0x33", "0x55" ] }
]
}
}
}
]
# comp cpi 22
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "==",
"right": 22
}
}
]
# comp cpi != 233
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "!=",
"right": 233
}
}
]
# comp cpi 33-45
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "==",
"right": {
"range": [ 33, 45 ]
}
}
}
]
# comp cpi != 33-45
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"range": [ 33, 45 ]
}
}
}
]
# comp cpi {33, 55, 67, 88}
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "==",
"right": {
"set": [
33,
55,
67,
88
]
}
}
}
]
# comp cpi != {33, 55, 67, 88}
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"set": [
33,
55,
67,
88
]
}
}
}
]
# comp cpi { 33-55}
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "==",
"right": {
"set": [
{ "range": [ 33, 55 ] }
]
}
}
}
]
# comp cpi != { 33-55}
[
{
"match": {
"left": {
"payload": {
"field": "cpi",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"set": [
{ "range": [ 33, 55 ] }
]
}
}
}
]