# icmp type {echo-reply, destination-unreachable, source-quench, redirect, echo-request, time-exceeded, parameter-problem, timestamp-request, timestamp-reply, info-request, info-reply, address-mask-request, address-mask-reply, router-advertisement, router-solicitation} accept
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "type",
                    "protocol": "icmp"
                }
            },
	    "op": "==",
            "right": {
                "set": [
                    "echo-reply",
                    "destination-unreachable",
                    "source-quench",
                    "redirect",
                    "echo-request",
                    "router-advertisement",
                    "router-solicitation",
                    "time-exceeded",
                    "parameter-problem",
                    "timestamp-request",
                    "timestamp-reply",
                    "info-request",
                    "info-reply",
                    "address-mask-request",
                    "address-mask-reply"
                ]
            }
        }
    },
    {
        "accept": null
    }
]

# icmp code { 2, 4, 54, 33, 56}
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "code",
                    "protocol": "icmp"
                }
            },
            "op": "==",
            "right": {
                "set": [
                    "prot-unreachable",
                    4,
                    33,
                    54,
                    56
                ]
            }
        }
    }
]

# icmp checksum { 1111, 222, 343} accept
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "checksum",
                    "protocol": "icmp"
                }
            },
	    "op": "==",
            "right": {
                "set": [
                    222,
                    343,
                    1111
                ]
            }
        }
    },
    {
        "accept": null
    }
]

# icmp checksum != { 1111, 222, 343} accept
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "checksum",
                    "protocol": "icmp"
                }
            },
            "op": "!=",
            "right": {
                "set": [
                    222,
                    343,
                    1111
                ]
            }
        }
    },
    {
        "accept": null
    }
]