Corngood , 6 months ago (edited 6 months ago)

I don’t have any previous knowledge of this at all, but from reading the docs, nothing you’re describing sounds wrong.

A u32 selector will match 4 bytes (u32 meaning unsigned 32bit presumably, which is 4 bytes).

It makes sense that you’d only be able to configure the matches on 4 byte intervals, because keeping them aligned may make the implementation simpler and more efficient. You can still match any set of bits this way.

Perhaps you could describe what you’re trying to match exactly and the selectors you tried.

Edit: also if you look at ‘raw payload expressions’ in nft: netfilter.org/projects/nftables/manpage.html

That seems like it would do what you want, and you can actually access the ethernet header in a documented way. You have to switch to nft though.