TCPUDP | icmp ICMP | mark VAL_MASK_32 | ether ETHER } IP := { { src | dst } { default ... prefixlen | netmask } ] } AT | { dsfield | ihl | protocol | precedence | icmp_type | icmp_…FLAG FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn SELECTOR := [ src ADDR ... sctp | dccp } [ sport PORT ] [ dport PORT ] | { icmp | ipv6-icm…following example makes the kernel yell "Incoming ICMP!" every time it sees an incoming ICMP ... ingress of eth0 that first matches ICMP then invokes the simple action to shoutLSID | ip_proto { tcp | udp | sctp | icmp | icmpv6 | l2tp | IP_PROTO } | ip_tos MASKED ... PROTO may be tcp , udp , sctp , icmp , icmpv6 , l2tp or an unsigned 8bit valueBEYOND_IPHDR_FIELD := { dport | sport | icmp_type | icmp_code } EX_IPHDR_FIELD := { ttl } IP6HDR_FIELD ... this will do unexpected things. icmp_type icmp_code Again, this allows on…unreachable. Packets are discarded and the ICMP message host unreachable is generated. The local senders ... unreachable. Packets are discarded and the ICMP message communication a…index. For example, to classify all ICMP packets as 'bulk', the following filter ... protocol ip prio 1 \ u32 match icmp type 0 0 action skbedit prioritycsum UPDATE UPDATE := TARGET [ UPDATE ] TARGET := { ip4h | icmp | igmp | tcp | udp | udplite | sctp | SWEETS } SWEETS ... which headers to update: IPv4 header ( ip4h ), ICMP header…upper layer protocols, namely TCP, UDP and ICMP. While for the first two only checksum ... takes care of embedded IP headers in ICMP packets by translating the respective address t…icmp frames will be dropped at any time with cycle 200ms. With a default basetime ... parent ffff: protocol ip \ flower ip_proto icmpfragmentation. EXAMPLES The following example encapsulates incoming ICMP packets on eth0 into a vxlan tunnel ... protocol ip parent ffff: \ flower \ ip_proto icmp \ action tunnelrestart classification so that it will match ICMP on the next rule, at prioflag inhibits this, resulting instead in an ICMP Unreachable (Fragmentation Required) message. Enabling this attributeflag inhibits this, resulting instead in an ICMP Unreachable (Fragmentation Required) message. Enabling this attributeones, if maximum table size was reached. icmp_error Number of packets which couldones, if maximum table size was reached. icmp_error Number of packets which couldones, if maximum table size was reached. icmp_error Number of packets which couldmaximize throughput) NNTP 0001 (minimize monetary cost) ICMP Errors 0000 Requests 0000 (mostly) Responses (mostlyprocess. EXAMPLES The following example encapsulates incoming ICMP packets on eth0 from 10.0.0.2 into VLANegress redirect dev lo Mirror all incoming ICMP packets on eth0 to a dummy interface