# phpman > man > tc-ematch(8)

[ematch(8)](https://www.chedong.com/phpMan.php/man/ematch/8/markdown)                                       Linux                                      [ematch(8)](https://www.chedong.com/phpMan.php/man/ematch/8/markdown)



## NAME
       ematch - extended matches for use with "basic", "cgroup"  or "flow" filters

## SYNOPSIS
       **tc** **filter** **add** **..** **basic** **match** EXPR **..** **flowid** **..**


       _EXPR_ := _TERM_ [ { **and** **|** **or** } _EXPR_ ]

       _TERM_ := [ **not** ] { _MATCH_ | '(' _EXPR_ ')' }

       _MATCH_ := _module_ '(' _ARGS_ ')'

       _ARGS_ := _ARG1_ _ARG2_ ..


## MATCHES
### cmp
       Simple comparison ematch: arithmetic compare of packet data to a given value.

       _cmp_( _ALIGN_ at _OFFSET_ [ _ATTRS_ ] { _eq_ | _lt_ | _gt_ } _VALUE_ )

       _ALIGN_ := { _u8_ | _u16_ | _u32_ }

       _ATTRS_ := [ layer _LAYER_ ] [ mask _MASK_ ] [ trans ]

       _LAYER_ := { _link_ | _network_ | _transport_ | _0..2_ }


### meta
       Metadata ematch

       _meta_( _OBJECT_ { _eq_ | _lt_ |_gt_ } _OBJECT_ )

       _OBJECT_ := { _META_ID_ |  _VALUE_ }

       _META_ID_ := _id_ [ shift _SHIFT_ ] [ mask _MASK_ ]


       meta attributes:

              **random** 32 bit random value

              **loadavg**___**1** Load average in last 5 minutes

              **nf**___**mark** Netfilter mark

              **vlan** Vlan tag

              **sk**___**rcvbuf** Receive buffer size

              **sk**___**snd**___**queue** Send queue length


       A full list of meta attributes can be obtained via

       # tc filter add dev eth1 basic match 'meta(list)'


### nbyte
       match packet data byte sequence

       _nbyte_( _NEEDLE_ at _OFFSET_ [ layer _LAYER_ ] )

       _NEEDLE_ := { _string_ | _c-escape-sequence_  }

       _OFFSET_ := _int_

       _LAYER_ := { _link_ | _network_ | _transport_ | _0..2_ }


### u32
       u32 ematch

       _u32_( _ALIGN_ _VALUE_ _MASK_ at [ nexthdr+ ] _OFFSET_ )

       _ALIGN_ := { _u8_ | _u16_ | _u32_ }


### ipset
       test packet against ipset membership

       _ipset_( _SETNAME_ _FLAGS_ )

       _SETNAME_ := _string_

       _FLAGS_ := { _FLAG_ [, _FLAGS_] }

       The flag options are the same as those used by the iptables "set" match.

       When using the ipset ematch with the "ip_set_hash:net,iface" set type, the interface can be
       queried using "src,dst (source ip address, outgoing interface) or "src,src" (source ip ad‐
       dress, incoming interface) syntax.


### ipt
       test packet against xtables matches

       _ipt_( _[-6]_ _-m_ _MATCH_NAME_ _FLAGS_ )

       _MATCH_NAME_ := _string_

       _FLAGS_ := { _FLAG_ [, _FLAGS_] }

       The flag options are the same as those used by the xtable match used.


### canid
       ematch rule to match CAN frames

       _canid_( _IDLIST_ )

       _IDLIST_ :=  _IDSPEC_[_IDLIST_]

       _IDSPEC_ := { ’sff’ _CANID_ | ’eff’ _CANID_ }

       _CANID_ := _ID_[_:MASK_]

       _ID_, _MASK_ := hexadecimal number (i.e. 0x123)


## CAVEATS
       The ematch syntax uses '(' and ')' to group expressions. All braces need to be escaped prop‐
       erly to prevent shell commandline from interpreting these directly.

       When using the ipset ematch with the "ifb" device, the outgoing device will be the ifb device
       itself, e.g. "ifb0".  The original interface (i.e. the device the packet arrived on) is
       treated as the incoming interface.


### EXAMPLE & USAGE
       # tc filter add .. basic match ...

       # 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'

       # 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'

       # 'nbyte("ababa" at 12 layer 1)'

       # 'u32(u16 0x1122 0xffff at nexthdr+4)'

       Check if packet source ip address is member of set named **bulk**:

       # 'ipset(bulk src)'

       Check if packet source ip and the interface the packet arrived on is member of
       "hash:net,iface" set named **interactive**:

       # 'ipset(interactive src,src)'

       Check if packet matches an IPSec state with reqid 1:

       # 'ipt(-m policy --dir in --pol ipsec --reqid 1)'


## AUTHOR
       The extended match infrastructure was added by Thomas Graf.



iproute2                                    6 August 2012                                  [ematch(8)](https://www.chedong.com/phpMan.php/man/ematch/8/markdown)