# Packet Filter Expressions¶

A packet filter expression takes a packet as input and returns a boolean value as output. It is used in many modules such as packet filters, packet classifiers, packet schedulers, various visualizers, and so on. The filter expression can be either a simple string literal or a full blown NED expression.

The string variant is basically a pattern that is matched against the name of the packet. It can still contain boolean operators such as and/or/not but it cannot refer to any part of the packet other than its name.

For example, the following pattern matches all packets having a name that starts with ‘ping’ and that doesn’t end with ‘reply’:

"ping* and not *reply"

The expression variant is evaluated by the module for each packet as needed. The expression can contain all NED expression syntax in addition to several implicitly defined variables as shown below. The implicitly defined variables can refer to the packet itself, to a protocol specific chunk, to a chunk with a specific chunk type, or to a packet tag with a specific type.

The following list gives a few examples:

expr(hasBitError) matches packets with bit error

expr(name == 'P1') matches packets having ‘P1’ as their name

expr(name =~ 'P*') matches packets having a name that starts with ‘P’

expr(totalLength >= 100B) matches packets longer than 100 bytes

Implicitly defined variables can be used to check the presence of a chunk of a specific protocol or of a chunk of a specific type:

expr(udp != null) matches packets that have at least one UDP protocol chunk

expr(has(udp)) shorthand for the above

expr(has(udp[0])) same as above using indexing

expr(has(UdpHeader)) matches packets that have at least one chunk with UdpHeader type

expr(has(UdpHeader[0])) same as above using indexing

expr(has(ipv4)) matches packets that have at least one IPv4 protocol chunk

expr(has(ipv4[0])) a packet may contain multiple protocol headers, they can be indexed

expr(has(Ipv4Header)) matches packets that have at least one chunk with Ipv4Header type

expr(has(Ipv4Header[0])) same as above using indexing

expr(has(ethernetmac)) matches packets that have at least one Ethernet MAC protocol chunk

expr(has(ethernetmac[0])) same as above using indexing

expr(has(ethernetmac[1])) this would most likely match the Ethernet FCS chunk

expr(has(EthernetMacHeader)) matches packets that have at least one chunk with EthernetMacHeader type

expr(has(EthernetMacHeader[0])) same as above using indexing

The expression can also refer to fields of chunks:

expr(ipv4.destAddress.getInt() == 0x0A000001) matches packets with a specific binary IPv4 destination address

expr(ipv4.destAddress.str() == '10.0.0.1') same as above using strings

expr(ipv4.destAddress.str() =~ '10.0.0.*') matches packets that have an IPv4 destination address starting with ‘10.0.0.’

expr(udp.destPort == 42) matches packets if the UDP destination port number equals to 42

It’s also possible to combine expressions using boolean operators:

expr(name == 'P1' && totalLength == 128B && ipv4.destAddress.str() == '10.0.0.1' && udp.destPort == 42)