# arp ptype 0x0800
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "ptype",
                    "protocol": "arp"
                }
            },
	    "op": "==",
            "right": "ip"
        }
    }
]

# arp operation {nak, inreply, inrequest, rreply, rrequest, reply, request}
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "operation",
                    "protocol": "arp"
                }
            },
	    "op": "==",
            "right": {
                "set": [
                    "request",
                    "reply",
                    "rrequest",
                    "rreply",
                    "inrequest",
                    "inreply",
                    "nak"
                ]
            }
        }
    }
]

# arp operation != {nak, inreply, inrequest, rreply, rrequest, reply, request}
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "operation",
                    "protocol": "arp"
                }
            },
            "op": "!=",
            "right": {
                "set": [
                    "request",
                    "reply",
                    "rrequest",
                    "rreply",
                    "inrequest",
                    "inreply",
                    "nak"
                ]
            }
        }
    }
]

# meta iifname "invalid" arp ptype 0x0800 arp htype 1 arp hlen 6 arp plen 4 @nh,192,32 0xc0a88f10 @nh,144,48 set 0x112233445566
[
    {
        "match": {
            "left": {
                "meta": { "key": "iifname" }
            },
	    "op": "==",
            "right": "invalid"
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "htype",
                    "protocol": "arp"
                }
            },
	    "op": "==",
            "right": 1
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "ptype",
                    "protocol": "arp"
                }
            },
	    "op": "==",
            "right": "ip"
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "hlen",
                    "protocol": "arp"
                }
            },
	    "op": "==",
            "right": 6
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "plen",
                    "protocol": "arp"
                }
            },
	    "op": "==",
            "right": 4
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "daddr ip",
                    "protocol": "arp"
                }
            },
	    "op": "==",
            "right": "192.168.143.16"
        }
    },
    {
        "mangle": {
            "key": {
                "payload": {
                    "field": "daddr ether",
                    "protocol": "arp"
                }
            },
            "value": "11:22:33:44:55:66"
        }
    }
]