FILL ME IN
- action:: The action to take when matched. See Actions section for valid options.
- comment:: A text comment enclosed in double-quotes. The comment can extend over multiple lines if desired, until a closing quote is encountered.
- destination-address:: One or more destination address tokens
- destination-exclude:: Exclude one or more address tokens from the specified destination-address
- destination-port:: One or more service definition tokens
- expiration:: stop rendering this term after specified date. YYYY-MM-DD
- icmp-code:: Specifies the ICMP code to filter on.
- icmp-type:: Specify icmp-type code to match, see section ICMP TYPES for list of valid arguments
- logging:: Specify that this packet should be logged via syslog.
- name:: Name of the term.
- option:: See platforms supported Options section.
- platform:: one or more target platforms for which this term should ONLY be rendered. *_platform-exclude:: one or more target platforms for which this term should NEVER be rendered.
- protocol:: the network protocols this term will match, such as tcp, udp, icmp, or a numeric value.
- source-address:: one or more source address tokens.
- source-exclude:: exclude one or more address tokens from the specified source-address.
- source-port:: one or more service definition tokens.
- accept
- deny
- next
- reject
- ack:: Match on ACK flag being present.
- all:: Matches all protocols.
- established:: Only match established connections, implements tcp-established for tcp and sets destination port to 1024- 65535 for udp if destination port is not defined.
- fin:: Match on FIN flag being present.
- is-fragment:: Matches on if a packet is a fragment.
- none:: Matches none.
- psh:: Match on PSH flag being present.
- rst:: Match on RST flag being present.
- syn:: Match on SYN flag being present.
- tcp-established:: Only match established tcp connections, based on statefull match or TCP flags. Not supported for other protocols.
- urg:: Match on URG flag being present.