{
    "content": [
        {
            "type": "text",
            "text": "# tc-ematch (man)\n\n## NAME\n\nematch - extended matches for use with \"basic\", \"cgroup\"  or \"flow\" filters\n\n## SYNOPSIS\n\ntc filter add .. basic match EXPR .. flowid ..\nEXPR := TERM [ { and | or } EXPR ]\nTERM := [ not ] { MATCH | '(' EXPR ')' }\nMATCH := module '(' ARGS ')'\nARGS := ARG1 ARG2 ..\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **MATCHES** (7 subsections)\n- **CAVEATS**\n- **AUTHOR**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n"
        }
    ],
    "structuredContent": {
        "command": "tc-ematch",
        "section": "",
        "mode": "man",
        "summary": "ematch - extended matches for use with \"basic\", \"cgroup\"  or \"flow\" filters",
        "synopsis": "tc filter add .. basic match EXPR .. flowid ..\nEXPR := TERM [ { and | or } EXPR ]\nTERM := [ not ] { MATCH | '(' EXPR ')' }\nMATCH := module '(' ARGS ')'\nARGS := ARG1 ARG2 ..",
        "tldr_summary": null,
        "tldr_examples": [],
        "tldr_source": null,
        "flags": [],
        "examples": [],
        "see_also": [],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "SYNOPSIS",
                "lines": 12,
                "subsections": []
            },
            {
                "name": "MATCHES",
                "lines": 1,
                "subsections": [
                    {
                        "name": "cmp",
                        "lines": 11
                    },
                    {
                        "name": "meta",
                        "lines": 29
                    },
                    {
                        "name": "nbyte",
                        "lines": 11
                    },
                    {
                        "name": "u32",
                        "lines": 7
                    },
                    {
                        "name": "ipset",
                        "lines": 15
                    },
                    {
                        "name": "ipt",
                        "lines": 11
                    },
                    {
                        "name": "canid",
                        "lines": 13
                    }
                ]
            },
            {
                "name": "CAVEATS",
                "lines": 33,
                "subsections": []
            },
            {
                "name": "AUTHOR",
                "lines": 3,
                "subsections": []
            }
        ],
        "sections": {
            "NAME": {
                "content": "ematch - extended matches for use with \"basic\", \"cgroup\"  or \"flow\" filters\n",
                "subsections": []
            },
            "SYNOPSIS": {
                "content": "tc filter add .. basic match EXPR .. flowid ..\n\n\nEXPR := TERM [ { and | or } EXPR ]\n\nTERM := [ not ] { MATCH | '(' EXPR ')' }\n\nMATCH := module '(' ARGS ')'\n\nARGS := ARG1 ARG2 ..\n\n",
                "subsections": []
            },
            "MATCHES": {
                "content": "",
                "subsections": [
                    {
                        "name": "cmp",
                        "content": "Simple comparison ematch: arithmetic compare of packet data to a given value.\n\ncmp( ALIGN at OFFSET [ ATTRS ] { eq | lt | gt } VALUE )\n\nALIGN := { u8 | u16 | u32 }\n\nATTRS := [ layer LAYER ] [ mask MASK ] [ trans ]\n\nLAYER := { link | network | transport | 0..2 }\n\n"
                    },
                    {
                        "name": "meta",
                        "content": "Metadata ematch\n\nmeta( OBJECT { eq | lt |gt } OBJECT )\n\nOBJECT := { METAID |  VALUE }\n\nMETAID := id [ shift SHIFT ] [ mask MASK ]\n\n\nmeta attributes:\n\nrandom 32 bit random value\n\nloadavg1 Load average in last 5 minutes\n\nnfmark Netfilter mark\n\nvlan Vlan tag\n\nskrcvbuf Receive buffer size\n\nsksndqueue Send queue length\n\n\nA full list of meta attributes can be obtained via\n\n# tc filter add dev eth1 basic match 'meta(list)'\n\n"
                    },
                    {
                        "name": "nbyte",
                        "content": "match packet data byte sequence\n\nnbyte( NEEDLE at OFFSET [ layer LAYER ] )\n\nNEEDLE := { string | c-escape-sequence  }\n\nOFFSET := int\n\nLAYER := { link | network | transport | 0..2 }\n\n"
                    },
                    {
                        "name": "u32",
                        "content": "u32 ematch\n\nu32( ALIGN VALUE MASK at [ nexthdr+ ] OFFSET )\n\nALIGN := { u8 | u16 | u32 }\n\n"
                    },
                    {
                        "name": "ipset",
                        "content": "test packet against ipset membership\n\nipset( SETNAME FLAGS )\n\nSETNAME := string\n\nFLAGS := { FLAG [, FLAGS] }\n\nThe flag options are the same as those used by the iptables \"set\" match.\n\nWhen  using  the ipset ematch with the \"ipsethash:net,iface\" set type, the interface can be\nqueried using \"src,dst (source ip address, outgoing interface) or \"src,src\"  (source  ip  ad‐\ndress, incoming interface) syntax.\n\n"
                    },
                    {
                        "name": "ipt",
                        "content": "test packet against xtables matches\n\nipt( [-6] -m MATCHNAME FLAGS )\n\nMATCHNAME := string\n\nFLAGS := { FLAG [, FLAGS] }\n\nThe flag options are the same as those used by the xtable match used.\n\n"
                    },
                    {
                        "name": "canid",
                        "content": "ematch rule to match CAN frames\n\ncanid( IDLIST )\n\nIDLIST :=  IDSPEC[IDLIST]\n\nIDSPEC := { ’sff’ CANID | ’eff’ CANID }\n\nCANID := ID[:MASK]\n\nID, MASK := hexadecimal number (i.e. 0x123)\n\n"
                    }
                ]
            },
            "CAVEATS": {
                "content": "The  ematch syntax uses '(' and ')' to group expressions. All braces need to be escaped prop‐\nerly to prevent shell commandline from interpreting these directly.\n\nWhen using the ipset ematch with the \"ifb\" device, the outgoing device will be the ifb device\nitself, e.g. \"ifb0\".  The original interface (i.e. the  device  the  packet  arrived  on)  is\ntreated as the incoming interface.\n\n\nEXAMPLE & USAGE\n# tc filter add .. basic match ...\n\n# 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'\n\n# 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'\n\n# 'nbyte(\"ababa\" at 12 layer 1)'\n\n# 'u32(u16 0x1122 0xffff at nexthdr+4)'\n\nCheck if packet source ip address is member of set named bulk:\n\n# 'ipset(bulk src)'\n\nCheck   if  packet  source  ip  and  the  interface  the  packet  arrived  on  is  member  of\n\"hash:net,iface\" set named interactive:\n\n# 'ipset(interactive src,src)'\n\nCheck if packet matches an IPSec state with reqid 1:\n\n# 'ipt(-m policy --dir in --pol ipsec --reqid 1)'\n\n",
                "subsections": []
            },
            "AUTHOR": {
                "content": "The extended match infrastructure was added by Thomas Graf.\n\niproute2                                    6 August 2012                                  ematch(8)",
                "subsections": []
            }
        }
    }
}