# tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 accept
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "dport",
                    "protocol": "tcp"
                }
            },
	    "op": "==",
            "right": 22
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "saddr",
                    "protocol": "ether"
                }
            },
	    "op": "==",
            "right": "00:0f:54:0c:11:04"
        }
    },
    {
        "accept": null
    }
]