3.2. Command Reference

• 3.2.1. cmd
  • cmd banner
    • Input Parameters
  • cmd reboot
    • Input Parameters
  • cmd poweroff
    • Input Parameters
  • cmd ping
    • Input Parameters
  • cmd traceroute
    • Input Parameters
  • cmd traffic-capture
    • Input Parameters
  • cmd traffic-capture new
    • Input Parameters
  • cmd traffic-capture list
  • cmd traffic-capture read
    • Input Parameters
  • cmd traffic-capture export
    • Input Parameters
  • cmd traffic-capture flush
  • cmd traffic-capture delete
    • Input Parameters
  • cmd identify-port
    • Input Parameters
  • cmd certificate cmp enroll
    • Input Parameters
  • cmd certificate cmp update
    • Input Parameters
  • cmd certificate cmp scheduled-update
    • Input Parameters
  • cmd system-image
    • Input Parameters
  • cmd backup
    • Input Parameters
  • cmd set-next-boot-params
    • Input Parameters
  • cmd license certificate
    • Input Parameters
  • cmd license file
    • Input Parameters
  • cmd license refresh
  • cmd troubleshooting-report
    • Input Parameters
  • cmd dns proxy clear-cache
    • Input Parameters
  • cmd dns resolve
    • Input Parameters
    • Output Data
  • cmd dhcp-client renew-lease
    • Input Parameters
  • cmd bgp rpki ssh-key create
    • Input Parameters
  • cmd bgp rpki ssh-key list
    • Input Parameters
  • cmd bgp rpki ssh-key delete
    • Input Parameters
  • cmd bgp rpki ssh-host add
    • Input Parameters
  • cmd bgp rpki ssh-host delete
    • Input Parameters
  • cmd certificate import
    • Input Parameters
  • cmd certificate export
    • Input Parameters
  • cmd certificate add
    • Input Parameters
  • cmd certificate delete
    • Input Parameters
  • cmd certificate-request delete
    • Input Parameters
  • cmd certificate-request generate
    • Input Parameters
  • cmd certificate-request export
    • Input Parameters
  • cmd compress-alarm
    • Input Parameters
    • Output Data
  • cmd twamp ping
    • Input Parameters
  • cmd aaa query
    • Input Parameters
    • Output Data
• 3.2.2. show
  • show vrfs
    • Output Data
  • show audit-trails
    • Input Parameters
    • Output Data
  • show summary
  • show commands
    • Output Data
  • show interface
    • Input Parameters
  • show interface throughput
    • Input Parameters
  • show ipv4-routes
    • Input Parameters
    • Output Data
  • show ipv4-routes summary
    • Input Parameters
    • Output Data
  • show ipv6-routes
    • Input Parameters
    • Output Data
  • show ipv6-routes summary
    • Input Parameters
    • Output Data
  • show mpls fec table
    • Input Parameters
  • show mpls table
    • Input Parameters
  • show disk
    • Output Data
  • show numa statistics
    • Output Data
  • show processes
    • Output Data
  • show soft-interrupts
    • Output Data
  • show hardware
    • Input Parameters
    • Output Data
  • show power
    • Output Data
  • show bgp
    • Input Parameters
  • show bgp segment-routing ipv6
    • Input Parameters
  • show bgp bmp
    • Input Parameters
    • Output Data
  • show bgp rpki cache-connection
    • Input Parameters
  • show bgp rpki cache-server
    • Input Parameters
  • show bgp rpki prefix-table
    • Input Parameters
  • show isis
    • Input Parameters
  • show evpn
    • Input Parameters
  • show ospf
    • Input Parameters
  • show rip
    • Input Parameters
  • show ospf6
    • Input Parameters
  • show ripng
    • Input Parameters
  • show mpls ldp
    • Input Parameters
  • show bfd
    • Input Parameters
  • show path-monitoring
    • Input Parameters
  • show nhrp
    • Input Parameters
  • show nhrp6
    • Input Parameters
  • show pim
    • Input Parameters
  • show pbr
    • Input Parameters
    • Output Data
  • show segment-routing te-policies
    • Input Parameters
  • show segment-routing te-database
    • Input Parameters
  • show segment-routing ipv6
    • Input Parameters
    • Output Data
  • show segment-routing pcep session
    • Input Parameters
    • Output Data
  • show segment-routing pcep session statistics
    • Input Parameters
    • Output Data
  • show license
  • show boot-params
    • Output Data
  • show log
    • Input Parameters
  • show logins
    • Input Parameters
    • Output Data
  • show user permissions
    • Input Parameters
    • Output Data
  • show ntp
    • Input Parameters
    • Output Data
  • show ntp clients
    • Input Parameters
    • Output Data
  • show dhcp-relay
    • Input Parameters
    • Output Data
  • show dhcp-server
    • Input Parameters
    • Output Data
  • show neighbors
    • Input Parameters
    • Output Data
  • show conntracks
    • Input Parameters
  • show product
    • Input Parameters
  • show fast-path cpu-usage
  • show fast-path table-usage
  • show fast-path arp parameters
    • Output Data
  • show fast-path ndp parameters
    • Output Data
  • show fast-path conntrack
    • Input Parameters
  • show fast-path conntrack statistics
    • Output Data
  • show fast-path hash-seed
    • Output Data
  • show fast-path statistics
    • Input Parameters
    • Output Data
  • show fast-path ports
    • Output Data
  • show ike
    • Input Parameters
  • show cg-nat pool-usage
    • Input Parameters
  • show cg-nat translation-usage
    • Input Parameters
  • show cg-nat user
    • Input Parameters
  • show cg-nat blocks
    • Input Parameters
  • show cg-nat conntracks
    • Input Parameters
  • show cg-nat conntrack-statistics
    • Input Parameters
  • show cg-nat translation-statistics
    • Input Parameters
  • show cg-nat block-statistics
    • Input Parameters
  • show cg-nat hash-table-statistics
  • show cg-nat mempool-usage
  • show cg-nat statistics
    • Output Data
  • show ha-neighbor
    • Input Parameters
  • show ha-conntrack
    • Input Parameters
  • show vxlan fdb
    • Input Parameters
    • Output Data
  • show bridge fdb
    • Input Parameters
    • Output Data
  • show dns-server
    • Input Parameters
    • Output Data
  • show certificate list
  • show certificate
    • Input Parameters
  • show certificate key
    • Input Parameters
  • show certificate-request list
  • show certificate-request key
    • Input Parameters
  • show certificate-request
    • Input Parameters
  • show certificate cmp scheduled-update
    • Input Parameters
  • show alarm list
    • Output Data
  • show alarm inventory
    • Output Data
  • show alarm summary
    • Output Data
  • show ipfix statistics
    • Input Parameters
    • Output Data
  • show commit
    • Output Data
  • show ipoe-server session
    • Input Parameters
    • Output Data
  • show ppp-server statistics
    • Input Parameters
    • Output Data
  • show gtp tunnels
    • Input Parameters
    • Output Data
  • show pfcp smf
    • Input Parameters
    • Output Data
  • show pfcp statistics
    • Input Parameters
    • Output Data
  • show lldp neighbors
    • Input Parameters
    • Output Data
• 3.2.3. flush
  • flush bgp
    • Input Parameters
  • flush isis
    • Input Parameters
  • flush ospf
    • Input Parameters
  • flush ospf6
    • Input Parameters
  • flush nhrp
    • Input Parameters
  • flush nhrp6
    • Input Parameters
  • flush pim
    • Input Parameters
  • flush ike ike-sa
    • Input Parameters
  • flush ike child-sa
    • Input Parameters
  • flush cg-nat statistics
  • flush cg-nat user
    • Input Parameters
  • flush cg-nat user-statistics
    • Input Parameters
  • flush fast-path statistics
  • flush fast-path conntrack
    • Input Parameters
  • flush vxlan fdb
    • Input Parameters
  • flush bridge fdb
    • Input Parameters
  • flush alarm
    • Input Parameters
    • Output Data
  • flush qos statistics
    • Input Parameters
  • flush conntracks
    • Input Parameters
  • flush certificate cmp scheduled-update
    • Input Parameters
  • flush dhcp-server lease
    • Input Parameters
  • flush neighbors
    • Input Parameters
  • flush login
    • Input Parameters
  • flush ppp-server session
    • Input Parameters
  • flush ipoe-server session
    • Input Parameters
• 3.2.4. system
  • hostname
  • cp-mask
  • timezone
  • date (state only)
  • troubleshooting-report (state only) (pushed)
  • traffic-capture (state only) (pushed)
  • network-stack
    • bridge
      • call-ipv4-filtering
      • call-ipv6-filtering
    • icmp
      • ignore-icmp-echo-broadcast
      • rate-limit-icmp
      • rate-mask-icmp
    • ipv4
      • forwarding
      • send-redirects
      • accept-redirects
      • accept-source-route
      • arp-announce
      • arp-filter
      • arp-ignore
      • arp-proxy
      • log-invalid-addresses
    • ipv6
      • forwarding
      • max-cached-routes
      • autoconfiguration
      • accept-duplicate-address-detection
      • accept-router-advert
      • accept-redirects
      • accept-segment-routing
      • accept-source-route
      • router-solicitations
      • use-temporary-addresses
    • neighbor
      • ipv4-max-entries
      • ipv6-max-entries
      • ipv4-base-reachable-time
      • ipv6-base-reachable-time
    • conntrack
      • max-entries
      • tcp-timeout-close
      • tcp-timeout-close-wait
      • tcp-timeout-established
      • tcp-timeout-fin-wait
      • tcp-timeout-last-ack
      • tcp-timeout-max-retrans
      • tcp-timeout-syn-recv
      • tcp-timeout-syn-sent
      • tcp-timeout-time-wait
      • tcp-timeout-unacknowledged
      • udp-timeout
      • udp-timeout-stream
    • fast-path
      • alg
        • port
        • session-timeout
      • conntrack
        • behavior
          • enabled (mandatory)
        • timeouts
          • icmp
            • <uint32> (mandatory)
          • udp
            • <uint32> (mandatory)
          • gre-pptp
            • <uint32> (mandatory)
          • tcp
            • <uint32> (mandatory)
        • nat64
          • option
            • true|false (mandatory)
          • mtu
            • <uint16> (mandatory)
  • audit-trail
    • enabled (pushed)
    • max-file-count
    • max-file-size
  • uptime (state only)
    • value (state only)
    • string (state only)
  • installed-image (state only)
    • version (state only)
    • current (state only)
    • default (state only)
    • next (state only)
    • confirm-pending (state only) (pushed)
  • aws
    • account-id (state only)
    • architecture (state only)
    • availability-zone (state only)
    • image-id (state only)
    • instance-id (state only)
    • instance-type (state only)
    • private-ip (state only)
    • region (state only)
    • ha-notification
      • group
        • assign-private-ip
        • change-route
          • interface (mandatory)
          • vrf (mandatory)
• 3.2.5. pki
  • ca-profile
    • cmp
      • vrf
      • url (mandatory)
      • server-certificate
      • issuer
      • private-key-algorithm
      • source
      • install-ca-certificates
      • automatic-update
        • remaining-time
        • retry-delay
    • revocation
      • crl
        • url
  • revocation
    • crl
      • vrf
      • source
  • certificate (state only)
    • subject (state only) (pushed)
    • issuer (state only) (pushed)
    • validity-not-before (state only) (pushed)
    • validity-not-after (state only) (pushed)
    • has-private-key (state only) (pushed)
  • certificate-request (state only)
    • subject (state only) (pushed)
• 3.2.6. cloud-init
  • enabled
  • datasource (state only)
• 3.2.7. license
  • enabled (pushed)
  • snmp
  • valid (state only) (pushed)
  • state (state only)
  • activation-type (state only)
  • license-type (state only)
  • short-license-type (state only)
  • subscription-end-date (state only)
  • support-type (state only)
  • support-end-date (state only) (pushed)
  • remaining-days (state only) (pushed)
  • remaining-days-string (state only) (pushed)
  • online
    • serial (mandatory) (hidden)
    • vrf
    • proxy-host
    • proxy-port
    • proxy-user
    • proxy-password (hidden)
    • export-analytics
    • use-ipv6-dns
    • source-ip
    • connected (state only) (pushed)
    • last-healthcheck-date (state only) (pushed)
    • lease-end-date (state only) (pushed)
    • current-activations (state only)
    • allowed-activations (state only)
    • license-tokens (state only)
    • computer-id (state only)
  • offline-certificate
    • serial (mandatory) (hidden)
    • computer-id (state only)
    • license-certificate (state only) (pushed)
  • offline
    • serial (mandatory) (hidden)
    • license-file (state only) (pushed)
  • throughput (deprecated) (state only)
    • allowed (deprecated) (state only) (pushed)
    • used (deprecated) (state only) (pushed)
  • cgnat-conntracks (deprecated) (state only)
    • allowed (deprecated) (state only) (pushed)
    • used (deprecated) (state only) (pushed)
  • ipsec-tunnels (deprecated) (state only)
    • allowed (deprecated) (state only) (pushed)
    • used (deprecated) (state only) (pushed)
  • licensed-feature (state only)
    • enabled (state only) (pushed)
    • counter (state only)
      • description (state only) (pushed)
      • allowed (state only) (pushed)
      • used (state only) (pushed)
• 3.2.8. auth
  • root-user-enabled
  • session-count (state only) (pushed)
  • role
    • priority
    • deny
      • config
      • state
      • rpc
        • vrf
          • l3vrf
      • notification
    • permit
      • config
        • access-permission
      • state
      • rpc
        • vrf
          • l3vrf
      • notification
  • user
    • role (mandatory)
    • password
    • ssh-enabled
    • authorized-key
  • session (state only)
    • user (state only) (pushed)
    • source (state only) (pushed)
    • started (state only) (pushed)
• 3.2.9. aaa
  • remote-authentication-order
  • local-authentication
  • user-role-privilege
    • viewer
    • admin
    • role
  • tacacs
    • address (mandatory)
    • port
    • source
    • secret (mandatory) (hidden)
    • timeout
    • vrf
  • radius
    • address (mandatory)
    • port
    • secret (mandatory) (hidden)
    • timeout
    • source
    • vrf
• 3.2.10. alarm
  • enabled
  • max-alarm-status-changes
  • notify-status-changes
  • notify-severity-level
  • alarm-inventory
    • alarm-type
      • resource (mandatory)
      • description (mandatory)
      • will-clear (state only)
      • severity-level (state only)
      • severity-level-trigger
        • text (mandatory)
        • above
        • below
        • equal
        • different
        • between
          • start
          • end
  • alarm-list (state only)
    • number-of-alarms (state only)
    • last-changed (state only)
    • alarm (state only)
      • alt-resource (state only)
      • time-created (state only)
      • is-cleared (state only)
      • last-raised (state only)
      • last-changed (state only)
      • perceived-severity (state only)
      • alarm-text (state only)
• 3.2.11. trigger
  • enabled
  • event
    • enabled
    • log
    • user
    • commands (mandatory)
    • on-alarm
      • alarm
      • severity-level
    • on-resource
      • resource (mandatory)
      • above
      • below
      • equal
      • different
      • between
        • start
        • end
    • on-cron
      • cron
• 3.2.12. vrf
  • l3vrf
    • table-id (mandatory)
• 3.2.13. ssh-server
  • enabled (pushed)
  • address
  • port
  • permit-root-login
• 3.2.14. netconf-server
  • enabled (pushed)
  • idle-timeout
  • address
    • port
    • description
• 3.2.15. dns
  • search
  • server
  • proxy
    • enabled
    • listen-to
    • forward
      • server
      • local
    • dns64
      • client (mandatory)
      • exclude
      • mapped
        • not
        • PREFIX
• 3.2.16. dns-server
  • enabled (pushed)
  • use-system-servers
  • bind
  • tls
    • certificate-name (mandatory)
    • dns-over-https
  • forward-tls
    • use-system-certificates
    • certificates
  • record
    • IP (mandatory)
  • logging
    • enabled
  • server
    • tls-authenticate-name
    • source
• 3.2.17. ipv6-autoconf
  • enabled (pushed)
  • interface
    • max-advertisement-interval
    • min-advertisement-interval
    • managed
    • other-config
    • link-mtu
    • reachable-time
    • retransmit-timer
    • default-lifetime
    • dhcp-prefix
      • suffix
      • on-link
      • valid-lifetime
      • preferred-lifetime
      • autonomous
      • base6-interface
      • base6to4-interface
      • address (state only)
    • prefix
      • on-link
      • valid-lifetime
      • preferred-lifetime
      • autonomous
      • base6-interface
      • base6to4-interface
      • send-interface-address (deprecated)
• 3.2.18. lldp
  • enabled (pushed)
  • hello-timer
  • system-name
  • system-description
  • management-address
  • chassis-id (state only)
  • chassis-id-type (state only)
  • interface
    • enabled
    • counters (state only)
      • frame-in (state only)
      • frame-out (state only)
      • frame-discard (state only)
      • tlv-discard (state only)
    • neighbor (state only)
      • port-id (state only)
      • port-id-type (state only)
      • port-description (state only)
      • management-address (state only)
      • system-name (state only)
      • system-description (state only)
      • chassis-id (state only)
      • chassis-id-type (state only)
      • capability (state only)
        • enabled (state only)
  • counters (state only)
    • frame-in (state only)
    • frame-out (state only)
    • frame-discard (state only)
    • tlv-discard (state only)
    • tlv-accepted (state only)
    • entries-aged-out (state only)
• 3.2.19. kpi
  • interface (deprecated)
• 3.2.20. telegraf
  • enabled (pushed)
  • interval
  • metrics
    • enabled
    • template
    • monitored-interface
    • metric
      • enabled
      • period
  • amazon-cloudwatch-output
    • write-statistics
    • high-resolution-metrics
    • authentication
      • ec2-authorized
      • explicit-credentials
        • access-key (mandatory)
        • secret-key (mandatory) (hidden)
        • security-token (hidden)
      • sts-credentials
        • arn-role (mandatory)
        • session-name
        • web-identity-token
  • elasticsearch-output
    • index-name
    • tls-ca-certificate
    • tls-certificate
    • insecure-skip-verify
    • metric-pass-filter
    • metric-drop-filter
  • graphite-output
    • prefix
    • metric-pass-filter
    • metric-drop-filter
  • influxdb-output
    • database (mandatory)
    • username
    • password (hidden)
    • insecure-skip-verify
    • metric-pass-filter
    • metric-drop-filter
  • influxdbv2-output
    • token (mandatory) (hidden)
    • organization (mandatory)
    • bucket (mandatory)
    • insecure-skip-verify
    • metric-pass-filter
    • metric-drop-filter
  • kafka-output
    • topic
    • data-format
    • tls-ca-certificate
    • tls-certificate
    • insecure-skip-verify
    • metric-pass-filter
    • metric-drop-filter
  • prometheus-client-output
    • metric-version
    • basic-username
    • basic-password (hidden)
    • expiration-interval
    • path
    • string-as-label
    • tls-certificate-name
    • tls-allowed-ca-certificate
    • export-timestamp
    • ip-range
    • metric-pass-filter
    • metric-drop-filter
• 3.2.21. tracker
  • logging
    • enabled
    • icmp
      • debug-echo
  • bfd
    • type
    • source (pushed)
    • address (mandatory) (pushed)
    • interface (pushed)
    • vrf (mandatory) (pushed)
    • l3vrf (pushed)
    • echo-mode
    • detection-multiplier
    • desired-transmission-interval
    • required-receive-interval
    • desired-echo-transmission-interval
    • discriminator (state only)
    • state (state only) (pushed)
    • diagnostic (state only) (pushed)
    • last-down-time (state only)
    • last-up-time (state only)
    • session-down-count (state only)
    • session-up-count (state only)
    • control-packet-input-count (state only)
    • control-packet-output-count (state only)
    • echo-packet-input-count (state only)
    • echo-packet-output-count (state only)
    • zebra-notification-count (state only)
    • remote (state only)
      • discriminator (state only)
      • diagnostic (state only) (pushed)
      • multiplier (state only)
    • negociated (state only)
      • transmission-interval (state only)
      • receive-interval (state only)
      • echo-transmission-interval (state only)
  • icmp
    • address (pushed)
    • vrf (mandatory) (pushed)
    • source (pushed)
    • interface
    • dhcp-interface
    • gateway
    • period
    • threshold
    • total
    • packet-size
    • packet-tos
    • timeout (pushed)
    • state (state only) (pushed)
    • diagnostic (state only) (pushed)
  • icmp-rtt
    • address (pushed)
    • vrf (mandatory) (pushed)
    • source (pushed)
    • interface
    • gateway
    • period
    • count
    • timestamp (state only) (pushed)
    • min-rtt (state only) (pushed)
    • max-rtt (state only) (pushed)
    • average-rtt (state only) (pushed)
    • loss-ratio (state only) (pushed)
• 3.2.22. nat
  • source-rule
    • description
    • protocol
      • not
      • VALUE (mandatory)
    • destination
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • source
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • mark
      • not
      • <0x0-0xffffffff> (mandatory)
      • mask
    • outbound-interface
      • not
      • <string> (mandatory)
    • translate-to
      • map
      • output-address
      • address
        • VALUE (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
      • address-range
        • START (mandatory)
        • END (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
    • counters (state only)
      • packets (state only)
      • bytes (state only)
  • destination-rule
    • description
    • protocol
      • not
      • VALUE (mandatory)
    • destination
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • source
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • mark
      • not
      • <0x0-0xffffffff> (mandatory)
      • mask
    • inbound-interface
      • not
      • <string> (mandatory)
    • translate-to
      • map
      • address
        • VALUE (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
      • address-range
        • START (mandatory)
        • END (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
    • counters (state only)
      • packets (state only)
      • bytes (state only)
• 3.2.23. cg-nat
  • enabled
  • alg
  • pool
    • address (mandatory)
    • block-allocation-mode
    • block-size
    • allocation-mode
      • dynamic-block
        • block-size (mandatory)
      • deterministic-block
        • block-size
      • dynamic-port
        • port-algo
        • port-overloading
          • unique-destination
          • protocol
          • factor
    • port-range
      • START
      • END
  • rule
    • deterministic-snat44
      • match
        • outbound-interface (mandatory)
        • source
          • ipv4-address (mandatory)
        • ds-lite
          • softwire-address (mandatory)
      • translate-to
        • pool-name (mandatory)
        • port-algo
        • max-conntracks-per-user
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
        • port-overloading
          • unique-destination
          • protocol
          • factor
    • deterministic-snat64
      • match
        • outbound-interface (mandatory)
        • source
          • ipv6-address (mandatory)
      • translate-to
        • pool-name (mandatory)
        • port-algo
        • max-conntracks-per-user
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
        • destination-prefix
        • port-overloading
          • unique-destination
          • protocol
          • factor
    • dynamic-snat44
      • match
        • outbound-interface (mandatory)
        • source
          • ipv4-address (mandatory)
        • ds-lite
          • softwire-address
      • translate-to
        • pool-name (mandatory)
        • max-blocks-per-user
        • active-block-timeout
        • user-timeout
        • port-algo
        • max-conntracks-per-user
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
        • port-overloading
          • unique-destination
          • protocol
          • factor
    • dynamic-port-snat44
      • match
        • outbound-interface (mandatory)
        • source
          • ipv4-address (mandatory)
        • ds-lite
          • softwire-address
      • translate-to
        • pool-name (mandatory)
        • user-timeout
        • max-conntracks-per-user
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
    • dynamic-snat64
      • match
        • outbound-interface (mandatory)
        • source
          • ipv6-address (mandatory)
      • translate-to
        • pool-name (mandatory)
        • max-blocks-per-user
        • active-block-timeout
        • user-timeout
        • port-algo
        • max-conntracks-per-user
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
        • destination-prefix
        • port-overloading
          • unique-destination
          • protocol
          • factor
    • dynamic-port-snat64
      • match
        • outbound-interface (mandatory)
        • source
          • ipv6-address (mandatory)
      • translate-to
        • pool-name (mandatory)
        • user-timeout
        • max-conntracks-per-user
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
        • destination-prefix
    • static-dnat44
      • match
        • inbound-interface (mandatory)
        • destination
          • ipv4-address (deprecated)
          • ipv4-range
      • translate-to
        • ipv4-address (deprecated)
        • ipv4-range
    • static-dnat46
      • match
        • inbound-interface (mandatory)
        • destination
          • ipv4-address (deprecated)
          • ipv4-range
      • translate-to
        • ipv6-address (deprecated)
        • ipv6-range
        • source-prefix
    • static-snat44
      • match
        • outbound-interface (mandatory)
        • source
          • ipv4-address (deprecated)
          • ipv4-range
      • translate-to
        • ipv4-address (deprecated)
        • ipv4-range
    • static-snat64
      • match
        • outbound-interface (mandatory)
        • source
          • ipv6-address (deprecated)
          • ipv6-range
      • translate-to
        • ipv4-address (deprecated)
        • ipv4-range
        • destination-prefix
  • conntrack
    • behavior
      • enabled (mandatory)
    • timeouts
      • icmp
        • <uint32> (mandatory)
      • udp
        • <uint32> (mandatory)
      • gre-pptp
        • <uint32> (mandatory)
      • tcp
        • <uint32> (mandatory)
    • nat64
      • option
        • true|false (mandatory)
      • mtu
        • <uint16> (mandatory)
  • logging
    • enabled
    • local
    • event
    • framing-method
    • rsyslog-server
      • port
      • vrf
      • source
      • connection-status (state only)
      • statistics (state only)
        • transmit (state only)
        • transmit-error (state only)
        • build-error (state only)
• 3.2.24. fast-path firewall
  • fast-path
    • enabled
    • conntrack-rule-set
      • origin
        • action
          • set-mark
          • set-mss
          • set-dscp
          • save-dscp
          • restore-dscp
      • reply
        • action
          • set-mark
          • set-mss
          • set-dscp
          • save-dscp
          • restore-dscp
    • rule
      • accept
        • action
          • set-mark
          • set-dscp
          • set-mss
      • drop
        • action
      • reject
        • action
      • track
        • apply
        • action
      • match
        • family
          • ipv4
            • source-address
              • not
              • VALUE (mandatory)
            • destination-address
              • not
              • VALUE (mandatory)
            • protocol
              • not
                • VALUE (mandatory)
              • any
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • tcp
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • udp
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • icmp
                • icmp-type
                  • not
                  • VALUE (mandatory)
              • number
                • <uint8> (mandatory)
            • source-application
              • VALUE (mandatory)
            • destination-application
              • VALUE (mandatory)
            • dscp
              • not
              • <uint32> (mandatory)
          • ipv6
            • source-address
              • not
              • VALUE (mandatory)
            • destination-address
              • not
              • VALUE (mandatory)
            • protocol
              • not
                • VALUE (mandatory)
              • any
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • tcp
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • udp
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • icmpv6
                • icmp-type
                  • not
                  • VALUE (mandatory)
              • number
                • <uint8> (mandatory)
            • source-application
              • VALUE (mandatory)
            • destination-application
              • VALUE (mandatory)
            • dscp
              • not
              • <uint32> (mandatory)
          • any
            • protocol
              • not
                • VALUE (mandatory)
              • any
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • tcp
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • udp
                • source-port
                  • not
                  • VALUE (mandatory)
                • destination-port
                  • not
                  • VALUE (mandatory)
              • number
                • <uint8> (mandatory)
            • source-application
              • VALUE (mandatory)
            • destination-application
              • VALUE (mandatory)
            • dscp
              • not
              • <uint32> (mandatory)
        • mark
          • not
          • VALUE (mandatory)
      • statistics (state only)
        • match (state only)
          • packets (state only)
          • bytes (state only)
        • conntrack (state only)
          • origin (state only)
            • packets (state only)
            • bytes (state only)
          • reply (state only)
            • packets (state only)
            • bytes (state only)
    • interface
      • ingress
        • rule
          • rule-name
          • statistics (state only)
            • match (state only)
              • packets (state only)
              • bytes (state only)
            • conntrack (state only)
              • origin (state only)
                • packets (state only)
                • bytes (state only)
              • reply (state only)
                • packets (state only)
                • bytes (state only)
      • egress
        • rule
          • rule-name
          • statistics (state only)
            • match (state only)
              • packets (state only)
              • bytes (state only)
            • conntrack (state only)
              • origin (state only)
                • packets (state only)
                • bytes (state only)
              • reply (state only)
                • packets (state only)
                • bytes (state only)
    • default
      • rule
        • rule-name (mandatory)
        • statistics (state only)
          • match (state only)
            • packets (state only)
            • bytes (state only)
          • conntrack (state only)
            • origin (state only)
              • packets (state only)
              • bytes (state only)
            • reply (state only)
              • packets (state only)
              • bytes (state only)
• 3.2.25. ddos-protection
  • enabled
  • tcp
    • syn
      • global
      • source
      • destination
      • unit
    • syn-ack
      • global
      • source
      • destination
      • unit
    • ack
      • global
      • source
      • destination
      • unit
    • rst
      • global
      • source
      • destination
      • unit
  • udp
    • dns
      • global
      • source
      • destination
      • unit
    • quic
      • global
      • source
      • destination
      • unit
    • raw
      • global
      • source
      • destination
      • unit
  • icmp
    • echo
      • global
      • source
      • destination
      • unit
  • trusted
    • ipv4
    • ipv6
• 3.2.26. ntp
  • enabled (pushed)
  • ntp-source-address
  • auth-key
    • key-value (hidden)
  • server-subnet
    • allow
    • deny
  • time-sources
    • makestep
      • threshold
      • limit
    • server
      • version
      • association-type
      • iburst
      • prefer
      • auth-key-id
      • stratum (state only)
      • root-delay (state only)
      • root-dispersion (state only)
      • offset (state only)
      • poll-interval (state only)
      • synchronized (state only)
      • state (state only)
  • server (state only)
    • version (state only)
    • association-type (state only)
    • iburst (state only)
    • prefer (state only)
    • stratum (state only)
    • root-delay (state only)
    • root-dispersion (state only)
    • offset (state only)
    • poll-interval (state only)
    • synchronized (state only)
    • state (state only)
    • auth-key-id (state only)
• 3.2.27. firewall
  • ipv4 filter
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv4 mangle
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • dscp
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • postrouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • rpfilter
          • invert
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv4 raw
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • notrack
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • notrack
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • rpfilter
          • invert
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv6 filter
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv6 mangle
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • postrouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • rpfilter
          • invert
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv6 raw
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • notrack
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • notrack
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set (mandatory)
          • examined
        • conntrack
          • status
            • not
            • VALUE (mandatory)
          • state
            • not
            • VALUE (mandatory)
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined (mandatory)
            • set
          • abort
            • examined (mandatory)
            • set
          • shutdown-complete
            • examined (mandatory)
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • rpfilter
          • invert
        • counters (state only)
          • packets (state only)
          • bytes (state only)
• 3.2.28. network-port (state only)
  • bus-addr (state only) (pushed)
  • device-tree-alias (state only) (pushed)
  • device-tree-compatible (state only) (pushed)
  • vendor (state only) (pushed)
  • model (state only) (pushed)
  • device-port (state only) (pushed)
  • mac-address (state only) (pushed)
  • interface (state only) (pushed)
• 3.2.29. interface
  • bridge
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ageing-time
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only) (pushed)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ddos-protection
      • enabled
    • ethernet
      • mac-address (pushed)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • prefix-delegation
        • request
        • current-lease (state only)
          • ia-address (state only)
          • renew (state only)
          • rebind (state only)
          • start (state only)
          • preferred-lifetime (state only)
          • max-lifetime (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-duplicate-address-detection
        • accept-router-advert
        • accept-redirects
        • accept-segment-routing
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • stp
      • enabled
      • priority
      • forward-delay
      • max-age
      • hello-time
    • link-interface
      • learning
    • qos
      • ingress
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • tcp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • udp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • icmp (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
            • icmpv6 (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
          • action (state only)
            • set-mark (state only)
            • restore-connmark (state only)
            • redirect (state only)
            • pass (state only)
            • set-priority (state only)
          • stats (state only)
            • match-packets (state only)
            • drop-packets (state only)
      • egress
        • scheduler (config only)
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • shaper (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
          • shaper (state only)
            • bandwidth (state only)
            • burst (state only)
            • layer1-overhead (state only)
            • queue-size (state only)
            • stats (state only)
              • pass-packets (state only)
              • drop-packets (state only)
        • scheduler (state only)
          • is-root (state only)
          • template-name (state only)
          • pq (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • pb-dwrr (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • quantum (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • htb (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • divisor (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • bandwidth (state only)
              • burst (state only)
              • ceiling (state only)
              • ceiling-burst (state only)
              • ceiling-priority (state only)
              • layer1-overhead (state only)
              • quantum (state only)
              • priority (deprecated) (state only)
              • child-queue (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • sfq (state only)
            • flows (state only)
            • quantum (state only)
            • limit (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • tcp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • udp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • icmp (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
            • icmpv6 (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
          • action (state only)
            • set-mark (state only)
            • restore-connmark (state only)
            • redirect (state only)
            • pass (state only)
            • set-priority (state only)
          • stats (state only)
            • match-packets (state only)
            • drop-packets (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • gre
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ttl
    • tos
    • link-interface
    • link-vrf
    • local (mandatory)
    • remote
    • checksum
    • sequence-number
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only) (pushed)
    • last-change (state only)
    • ddos-protection (deprecated)
      • enabled (deprecated)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-duplicate-address-detection
        • accept-router-advert
        • accept-redirects
        • accept-segment-routing
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • key
      • input (hidden)
      • output (hidden)
      • both (hidden)
    • qos
      • ingress
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • tcp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • udp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • icmp (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
            • icmpv6 (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
          • action (state only)
            • set-mark (state only)
            • restore-connmark (state only)
            • redirect (state only)
            • pass (state only)
            • set-priority (state only)
          • stats (state only)
            • match-packets (state only)
            • drop-packets (state only)
      • egress
        • scheduler (config only)
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • shaper (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
          • shaper (state only)
            • bandwidth (state only)
            • burst (state only)
            • layer1-overhead (state only)
            • queue-size (state only)
            • stats (state only)
              • pass-packets (state only)
              • drop-packets (state only)
        • scheduler (state only)
          • is-root (state only)
          • template-name (state only)
          • pq (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • pb-dwrr (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • quantum (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • htb (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • divisor (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • bandwidth (state only)
              • burst (state only)
              • ceiling (state only)
              • ceiling-burst (state only)
              • ceiling-priority (state only)
              • layer1-overhead (state only)
              • quantum (state only)
              • priority (deprecated) (state only)
              • child-queue (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • sfq (state only)
            • flows (state only)
            • quantum (state only)
            • limit (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • tcp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • udp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • icmp (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
            • icmpv6 (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
          • action (state only)
            • set-mark (state only)
            • restore-connmark (state only)
            • redirect (state only)
            • pass (state only)
            • set-priority (state only)
          • stats (state only)
            • match-packets (state only)
            • drop-packets (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • gretap
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ttl
    • tos
    • link-interface
    • link-vrf
    • local (mandatory)
    • remote
    • checksum
    • sequence-number
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only) (pushed)
    • last-change (state only)
    • ddos-protection (deprecated)
      • enabled (deprecated)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-duplicate-address-detection
        • accept-router-advert
        • accept-redirects
        • accept-segment-routing
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • ethernet
      • mac-address (pushed)
    • key
      • input (hidden)
      • output (hidden)
      • both (hidden)
    • qos
      • ingress
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • tcp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • udp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • icmp (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
            • icmpv6 (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
          • action (state only)
            • set-mark (state only)
            • restore-connmark (state only)
            • redirect (state only)
            • pass (state only)
            • set-priority (state only)
          • stats (state only)
            • match-packets (state only)
            • drop-packets (state only)
      • egress
        • scheduler (config only)
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • shaper (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
          • shaper (state only)
            • bandwidth (state only)
            • burst (state only)
            • layer1-overhead (state only)
            • queue-size (state only)
            • stats (state only)
              • pass-packets (state only)
              • drop-packets (state only)
        • scheduler (state only)
          • is-root (state only)
          • template-name (state only)
          • pq (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • pb-dwrr (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • quantum (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • htb (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • divisor (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • bandwidth (state only)
              • burst (state only)
              • ceiling (state only)
              • ceiling-burst (state only)
              • ceiling-priority (state only)
              • layer1-overhead (state only)
              • quantum (state only)
              • priority (deprecated) (state only)
              • child-queue (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • sfq (state only)
            • flows (state only)
            • quantum (state only)
            • limit (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • tcp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • udp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • icmp (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
            • icmpv6 (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
          • action (state only)
            • set-mark (state only)
            • restore-connmark (state only)
            • redirect (state only)
            • pass (state only)
            • set-priority (state only)
          • stats (state only)
            • match-packets (state only)
            • drop-packets (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • gtp
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only) (pushed)
    • last-change (state only)
    • ddos-protection (deprecated)
      • enabled (deprecated)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • qos-hub
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only) (pushed)
    • last-change (state only)
    • ddos-protection (deprecated)
      • enabled (deprecated)
    • qos
      • ingress
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • tcp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • udp (state only)
              • match-all (state only)
              • source-port (state only)
                • value (state only)
                • mask (state only)
              • destination-port (state only)
                • value (state only)
                • mask (state only)
            • icmp (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
            • icmpv6 (state only)
              • match-all (state only)
              • type (state only)
                • value (state only)
                • mask (state only)
              • code (state only)
                • value (state only)
                • mask (state only)
          • action (state only)
            • set-mark (state only)
            • restore-connmark (state only)
            • redirect (state only)
            • pass (state only)
            • set-priority (state only)
          • stats (state only)
            • match-packets (state only)
            • drop-packets (state only)
      • egress
        • scheduler (config only)
        • policy (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • shaper (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
          • shaper (state only)
            • bandwidth (state only)
            • burst (state only)
            • layer1-overhead (state only)
            • queue-size (state only)
            • stats (state only)
              • pass-packets (state only)
              • drop-packets (state only)
        • scheduler (state only)
          • is-root (state only)
          • template-name (state only)
          • pq (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • pb-dwrr (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • quantum (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • htb (state only)
            • nb-queue (state only)
            • default-queue (state only)
            • divisor (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • bandwidth (state only)
              • burst (state only)
              • ceiling (state only)
              • ceiling-burst (state only)
              • ceiling-priority (state only)
              • layer1-overhead (state only)
              • quantum (state only)
              • priority (deprecated) (state only)
              • child-queue (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • enqueue-bytes (state only)
                • xmit-packets (state only)
                • xmit-bytes (state only)
                • drop-queue-full (state only)
                • drop-queue-full-bytes (state only)
          • sfq (state only)
            • flows (state only)
            • quantum (state only)
            • limit (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • enqueue-bytes (state only)
              • xmit-packets (state only)
              • xmit-bytes (state only)
              • drop-queue-full (state only)
              • drop-queue-full-bytes (state only)
        • policy (state only)
          • priority (state only)
          • selector (state only)
            • match8bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match16bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • match32bits (state only)
              • value (state only)
              • mask (state only)
              • offset (state only)
            • ipv4 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)
                • value (state only)
                • mask (state only)
              • tos (state only)
                • value (state only)
                • mask (state only)
              • dscp (state only)
                • value (state only)
            • ipv6 (state only)
              • match-all (state only)
              • source (state only)
              • destination (state only)
              • protocol (state only)