# comp nexthdr != esp
[
{
"match": {
"left": {
"payload": {
"field": "nexthdr",
"protocol": "comp"
}
},
"op": "!=",
"right": 50
}
}
]
# comp flags 0x0
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": 0
}
}
]
# comp flags != 0x23
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": 35
}
}
]
# comp flags 0x33-0x45
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": {
"range": [ 51, 69 ]
}
}
}
]
# comp flags != 0x33-0x45
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"range": [ 51, 69 ]
}
}
}
]
# comp flags {0x33, 0x55, 0x67, 0x88}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": {
"set": [
51,
85,
103,
136
]
}
}
}
]
# comp flags != {0x33, 0x55, 0x67, 0x88}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"set": [
51,
85,
103,
136
]
}
}
}
]
# comp flags { 0x33-0x55}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "==",
"right": {
"set": [
{ "range": [ 51, 85 ] }
]
}
}
}
]
# comp flags != { 0x33-0x55}
[
{
"match": {
"left": {
"payload": {
"field": "flags",
"protocol": "comp"
}
},
"op": "!=",
"right": {
"set": [
{ "range": [ 51, 85 ] }
]
}
}
}
]