- icmptype (offset of ICMP type field)
- icmpcode (offset of ICMP code field)
- tcpflags (offset of TCP flags field)
and field values:
- icmp-echoreply, icmp-unreach, icmp-sourcequench,
icmp-redirect, icmp-echo, icmp-routeradvert,
icmp-routersolicit, icmp-timxceed, icmp-paramprob,
icmp-tstamp, icmp-tstampreply, icmp-ireq, icmp-ireqreply,
icmp-maskreq, icmp-maskreply
- tcp-fin, tcp-syn, tcp-rst, tcp-push, tcp-ack, tcp-urg
This allows expressions like the following:
icmp[0] = 3
(tcp[13] & 0x02) != 0
to be written as:
icmp[icmptype] = icmp-unreach
(tcp[tcpflags] & tcp-syn) != 0
which is a bit more user-friendly for e.g. writing packet filter rules.
e9c2ed11fe