Where <source> is { address <address> | mac-address <address> | port <port> }.

address <address>

Specifies an address to match.

Address formats are as follows:

• <address-group-name>: An address group that is configured with a list of addresses.
• <ip-address>: An IPv4 address.
• <ip-address/prefix>: An IPv4 network, where 0.0.0.0/0 matches any prefix.
• !<ip-address>: All IP addresses except the specified IPv4 address.
• !<ip-address/prefix>: All IP addresses except the specified IPv4 network prefix.
• <ipv6-address>: An IPv6 address; for example, fe80::20c:29fe:fe47:f89.
• <ip-address/prefix>: An IPv6 network prefix, where ::/0 matches any prefix; for example, fe80::20c:29fe:fe47:f88/64.
• !<ipv6-address>: All IPv6 addresses except the specified IPv6 address.
• !<ip-address/prefix>: All IPv6 prefixes except the specified IPv6 network prefix.

Note: If you specify both an address and a port then the system will treat a packet as a match only when both its address and its port values match those specifications.

mac-address <mac-address>

Specifies a media access control (MAC) address to match. The address format is six 8-bit numbers, separated by colons, in hexadecimal; for example, 00:0a:59:9a:f2:ba.

port <port>

Specifies a port to match.

Port formats are as follows:

• <port-group name>: A port group that is configured with a list of ports.
• <port name>: A port name as shown in /etc/services, such as http.
• <start-end>: A range of port numbers, such as 1001-1005.