If a name is used, both the port number and protocol are checked. True if the packet has a source port value of port . True if either the source or destination port of the packet is port . True if the packet has a length less than or equal to length . True if the packet has a length greater than or equal to length .
Protocol can be a number or one of the names tcp , udp or icmp .
True if the packet is an IP multicast packet. Proto is one of ip, tcp, udp or icmp , and indicates the protocol layer for the index operation. The byte offset, relative to the indicated protocol layer, is given by expr . The length operator, indicated by the keyword len , gives the length of the packet. This check is implicitly applied to the tcp and udp index operations.