Conditions decide which packets a rule sees.

A condition combines protocol tests, comparisons on header fields and payload matches with and, or, not and parentheses.

Protocol tests

Fields

Comparisons

Matching the payload

payload[OFF:LEN] compares a slice at a fixed place. payload contains finds text or bytes anywhere in the first 256 bytes, or in a window of up to 512.

rule source_query {
    when udp.dport == 27015 and payload[0:4] == 0xffffffff
    then limit 10/s per ip.src burst 20
}

rule admin_probe {
    when tcp.dport == 80 and payload contains "GET /admin"
    then drop
}

A slice reads LEN bytes (1 to 32) starting OFF bytes after the transport header, ending no later than byte 1500. Packets too short for the slice do not match.

payload[OFF:LEN] contains TEXT looks in a window of LEN bytes from OFF, and the window must end by byte 512. not contains is true only when the packet carries at least OFF plus the text's length in payload bytes, so a SYN, a bare ACK or an empty datagram is neither.

The end of the payload comes from the IP length, so the Ethernet padding of a short frame is not payload: payload contains never matches padding bytes, and an empty datagram padded to 60 bytes still has no payload.

A file can use at most 16 distinct text and window pairs: the kernel checks each search on its own when loading. Using the same text and window in several rules counts once.

IPv6 and VLANs

On IPv6, moat skips up to four hop-by-hop, routing, fragment and destination options headers. vlan.id is the first 802.1Q or 802.1ad tag; with two tags the inner one is not read and the packet has no IP fields.

Objects from moat build and moat test never ask the driver for the tag, since that ties a program to one interface.