NTPL Filter Examples

Adding NTPL filter expressions

Refer to Adding an NTPL Expression for instructions on how to add NTPL expressions to the configuration.

Filter on ports

Filter on a port, use mTcpDestPort for TCP destination port and mTcpSrcPort for TCP source port:

Assign[StreamId=0] = (Port == 0) AND (mTcpDestPort==8080)

Filter on several ports:

Assign[StreamId=0] = (Port == 0) AND (mTcpDestPort == 8080, 8081, 8089)

Filter on a range of ports:

Assign[StreamId=0] = (Port == 0) AND (mTcpSrcPort == (0x100..0x400))

Filtering on UDP ports can be done in the same way.

Filter on IP addresses

Filter on an IP address, use mIPv4SrcAddrIP for IPv4 source address and mIPv4DestAddrIP for IPv4 destination address:

Assign[StreamId=0] = (Port == 0) AND (mIPv4SrcAddrIP == [192.168.1.1])

Filter on an IP range of addresses (192.168.1.10 – 192.168.1.20):

Assign[StreamId=0] = (Port == 0) AND (mIPv4SrcAddrIP == ([192.168.1.10]..[192.168.1.20]))

Filter on an IP subnet (all addresses from 192.168.1.0 to 192.168.1.255 using a bit mask):

Assign[StreamId=0] = (Port == 0) AND (mIPv4DestAddrIP == {[FF.FF.FF.00]:[192.168.1.0]})

Filter on protocols

Filter on a protocol:

Assign[StreamId=0] = (Port == 0) AND (layer3protocol == IPv4)

Filter on several protocols:

Assign[StreamId=0] = (Port == 0 ) AND (Layer4Protocol == UDP, TCP, ICMP)

Filter on error packets

Look for errored packets:

Assign[StreamId=0] = (CrcError == TRUE OR (IpChecksumError == TRUE OR (UdpChecksumError == TRUE OR TcpChecksumError == TRUE)))