Basic Filtering (cont)

• ip = srcdst [flags] [with withopt] [imcp]

• with = "with" | "and"

• withopt = ["not" | "no"] opttype [withopt]

• opttype = "ipopt" | "short" | "frag" | "opt" ipopts

• ipopts = optlist | "sec-class" [secname]

• optlist = optname | ["," optlist]

• secname = seclvl ["," secname]

• seclvl = "unclass" | "config" | ...

• optname = "nop" | "rr" | ..

Notes: