# Element \<find>

## Attribute

<table><thead><tr><th width="150">Attribute</th><th width="150">Alternative</th><th width="215">Description</th><th width="156">Type</th><th>Default (* must have)</th></tr></thead><tbody><tr><td>id</td><td></td><td>Specifies a unique id for an element</td><td>Interger</td><td></td></tr><tr><td>name</td><td>n</td><td>refer to wireshark filter function, but less item</td><td>String</td><td>*</td></tr><tr><td>relation</td><td>r</td><td>Equal or Not equal</td><td><p>==/!=</p><p>>=/&#x3C;= (v3.9)</p></td><td>*</td></tr><tr><td>content</td><td>c</td><td>content of name, could be empty</td><td>String</td><td>*</td></tr></tbody></table>

### Attribute -name

<table><thead><tr><th width="151.32440213813035">name</th><th width="177">type</th><th width="166.61725067385444">Description</th><th width="175">Example</th><th>Support</th></tr></thead><tbody><tr><td>eth.addr</td><td>MAC address</td><td>Source or Destination MAC address</td><td>eth.addr == 12:34:56:78:9a:bc</td><td></td></tr><tr><td>eth.src</td><td>MAC address</td><td>Source MAC address</td><td>eth.src == 12:34:56:78:9a:bc</td><td></td></tr><tr><td>eth.dst</td><td>MAC address</td><td>Destination MAC address</td><td>eth.dst == 12:34:56:78:9a:bc</td><td></td></tr><tr><td>eth.type</td><td>Unsigned integer, 2 bytes</td><td>EtherType</td><td>eth.type == 2048 (IPv4 0x0800)</td><td></td></tr><tr><td>vlan.id</td><td>Unsigned integer, 2 bytes</td><td>vlan id</td><td>vlan.id == 5</td><td></td></tr><tr><td>vlan.l2.id</td><td>Unsigned integer, 2 bytes</td><td>vlan layer 2 id</td><td>vlan.l2.id == 1</td><td></td></tr><tr><td>vlan.priority</td><td>Unsigned integer, 2 bytes</td><td>Priority</td><td>vlan.priority == 5</td><td></td></tr><tr><td>ip</td><td></td><td>is IPv4</td><td>ip ==</td><td></td></tr><tr><td>ip.addr</td><td>IPv4 address</td><td>Source or Destination Address</td><td>ip.addr == 8.8.8.8</td><td></td></tr><tr><td>ip.src</td><td>IPv4 address</td><td>Source Address</td><td>ip.src == 8.8.8.8</td><td></td></tr><tr><td>ip.dst</td><td>IPv4 address</td><td>Destination Address</td><td>ip.dst == 8.8.8.8</td><td></td></tr><tr><td>ip.proto</td><td>Unsigned integer, 1 byte</td><td>Protocol</td><td>ip.proto == 6 (TCP)</td><td></td></tr><tr><td>ip.fragment</td><td></td><td>is IPv4 Fragment</td><td>ip.fragment ==</td><td></td></tr><tr><td>ip.flags.df</td><td>Unsigned integer, 1 byte</td><td>is IP don't fragment</td><td>ip.flags.df == 1</td><td>v3.9</td></tr><tr><td>ip.flags.mf</td><td>Unsigned integer, 1 byte</td><td>is IP more fragment</td><td>ip.flags.mf == 1</td><td>v3.9</td></tr><tr><td>ip.dsfield</td><td>Unsigned integer, 1 byte</td><td>Differentiated Services Field</td><td>ip.dsfield == 1</td><td></td></tr><tr><td>ipv6</td><td></td><td>is IPv6</td><td>ipv6 ==</td><td></td></tr><tr><td>ipv6.addr</td><td>IPv6 address</td><td>Source or Destination Address</td><td>ipv6.addr == 2001:0db8:86a3:08d3:1319:8a2e:0370:7344</td><td></td></tr><tr><td>ipv6.src</td><td>IPv6 address</td><td>Source Address</td><td>ipv6.src == 2001:0db8:86a3:08d3:1319:8a2e:0370:7344</td><td></td></tr><tr><td>ipv6.dst</td><td>IPv6 address</td><td>Destination Address</td><td>ipv6.dst == 2001:0db8:86a3:08d3:1319:8a2e:0370:7344</td><td></td></tr><tr><td>ipv6.nxt</td><td>Unsigned integer, 1 byte</td><td>Next Header</td><td></td><td></td></tr><tr><td>tcp</td><td></td><td>is TCP</td><td>tcp ==</td><td></td></tr><tr><td>tcp.port</td><td>Unsigned integer, 2 bytes</td><td>Source or Destination Port</td><td>tcp.port == 443</td><td></td></tr><tr><td>tcp.srcport</td><td>Unsigned integer, 2 bytes</td><td>Source Port</td><td>tcp.srcport == 443</td><td></td></tr><tr><td>tcp.dstport</td><td>Unsigned integer, 2 bytes</td><td>Destination Port</td><td>tcp.dstport == 443</td><td></td></tr><tr><td>tcp.flags.syn</td><td>0 or 1</td><td>Syn</td><td>tcp.flags.syn == 1</td><td></td></tr><tr><td>tcp.flags.ack</td><td>0 or 1</td><td>Ack</td><td>tcp.flags.ack == 1</td><td></td></tr><tr><td>tcp.flags.fin</td><td>0 or 1</td><td>Fin</td><td>tcp.flags.fin == 1</td><td></td></tr><tr><td>tcp.flags.reset</td><td>0 or 1</td><td>Reset</td><td>tcp.flags.rst == 1</td><td></td></tr><tr><td>udp</td><td></td><td>is UDP</td><td>udp ==</td><td></td></tr><tr><td>udp.port</td><td>Unsigned integer, 2 bytes</td><td>Source or Destination Port</td><td>udp.port == 53</td><td></td></tr><tr><td>udp.srcport</td><td>Unsigned integer, 2 bytes</td><td>Source Port</td><td>udp.srcport == 53</td><td></td></tr><tr><td>udp.dstport</td><td>Unsigned integer, 2 bytes</td><td>Destination Port</td><td>udp.dstport == 53</td><td></td></tr><tr><td>sctp</td><td></td><td>is SCTP</td><td>sctp ==</td><td></td></tr><tr><td>sctp.port</td><td>Unsigned integer, 2 bytes</td><td>Source or Destination Port</td><td>sctp.port == 2906</td><td></td></tr><tr><td>sctp.srcport</td><td>Unsigned integer, 2 bytes</td><td>Source Port</td><td>sctp.srcport == 2906</td><td></td></tr><tr><td>sctp.dstport</td><td>Unsigned integer, 2 bytes</td><td>Destination Port</td><td>sctp.dstport == 2906</td><td></td></tr><tr><td>5-tuple</td><td>5 Tuple, - means don't care</td><td>Source IP Address, Destination IP Address, Protocol, Source Port, Destination Port</td><td>5-tuple == - 192.168.1.203 - - 443</td><td></td></tr><tr><td>gtp.cp</td><td></td><td></td><td></td><td></td></tr><tr><td>gtp.data</td><td></td><td></td><td></td><td></td></tr><tr><td>gtp.imsi</td><td></td><td></td><td></td><td></td></tr><tr><td>gtp.teid</td><td></td><td></td><td></td><td></td></tr><tr><td>ip.addr.related.gtp.imsi</td><td></td><td></td><td>ip.addr.related.gtp.imsi == 466100000001007</td><td></td></tr><tr><td>gre</td><td></td><td>is GRE</td><td>gre ==</td><td></td></tr><tr><td>vxlan</td><td></td><td>is VXLAN</td><td>vxlan ==</td><td>v5.2</td></tr><tr><td>vxlan.vni</td><td>Unsigned integer, 3 bytes</td><td>VXLAN vni</td><td>vxlan.vni == 1</td><td>v5.2</td></tr><tr><td>erspan.spanid</td><td></td><td>ERSPAN id</td><td>erspan.spanid == 1</td><td></td></tr><tr><td>voip</td><td></td><td>is SIP or RTP</td><td>voip ==</td><td></td></tr><tr><td>voip.account</td><td></td><td></td><td>voip.account == 212@o.gentrice.net</td><td></td></tr><tr><td>voip.from</td><td></td><td></td><td>voip.from == 212@o.gentrice.net</td><td></td></tr><tr><td>voip.to</td><td></td><td></td><td>voip.to == 212@o.gentrice.net</td><td></td></tr><tr><td>dns.a</td><td>IPv4 address</td><td>DNS type A ip addresses</td><td>dns.a == 216.239.32.10</td><td></td></tr><tr><td>dns.flags.response</td><td>0 or 1</td><td>DNS Response</td><td>dns.flags.response == 1</td><td></td></tr><tr><td>dns.count.add_rr</td><td>int</td><td>DNS additional records count</td><td>dns.count.add_rr == 1</td><td></td></tr><tr><td>dns.qry.type</td><td>int</td><td>DNS query type</td><td>dns.qry.type == 1</td><td></td></tr><tr><td>dns.qry.name</td><td>Character string</td><td>DNS query name</td><td>dns.qry.name == google.com</td><td></td></tr><tr><td>dns.qry.name_public_suffix</td><td>Character string</td><td>DNS query name public suffix</td><td>dns.qry.name_public_suffix == *.googlevideo.com</td><td></td></tr><tr><td>dns.qry.name.resp.ip.addr</td><td>Character string</td><td>DNS query name response ip addr</td><td>dns.qry.name.resp.ip.addr == googlevideo.com</td><td></td></tr><tr><td>http</td><td></td><td>is HTTP</td><td>http ==</td><td></td></tr><tr><td>http.request</td><td></td><td>is HTTP request</td><td>http.request ==</td><td></td></tr><tr><td>http.host</td><td>Character string</td><td>HTTP host</td><td>http.host == yahoo.com</td><td>v5.3</td></tr><tr><td>http.request.uri</td><td>Character string</td><td>HTTP request uri</td><td>http.request.uri == /index.html</td><td>v5.3</td></tr><tr><td>http.request.method</td><td>GET,HEAD,POST,etc.</td><td>HTTP request method</td><td>http.request.method == GET</td><td></td></tr><tr><td>http.request.url</td><td>url</td><td>HTTP request url</td><td>http.request.url == www.whitehollowtransport.com/current-elliott-c-89.html</td><td></td></tr><tr><td>ssl</td><td></td><td>is SSL</td><td>ssl ==</td><td></td></tr><tr><td>ssl.server_name</td><td>Character string</td><td>SSL server_name</td><td>ssl.server_name == facebook.com</td><td></td></tr><tr><td>ssl.server_name_public_suffix</td><td>Character string</td><td>SSL server_name public suffix</td><td>ssl.server_name_public_suffix == *.googlevideo.com</td><td></td></tr><tr><td>ssl.handshake.type</td><td>0 or 1</td><td>SSL handshake type</td><td>ssl.handshake.type == 1</td><td></td></tr><tr><td>ssl.ja3_digest</td><td></td><td>SSL ja3 digest</td><td>ssl.ja3_digest == 39e62db039deed96a9daf75dacdbd207</td><td></td></tr><tr><td>ssl.ja3s_digest</td><td></td><td>SSL ja3s digest</td><td>ssl.ja3s_digest == 15af977ce25de452b96affa2addb1036</td><td>v5.3</td></tr><tr><td>arp</td><td></td><td>is ARP</td><td>arp ==</td><td></td></tr><tr><td>arp.request</td><td></td><td>is ARP request</td><td>arp.request ==</td><td></td></tr><tr><td>arp.reply</td><td></td><td>is ARP reply</td><td>arp.reply ==</td><td></td></tr><tr><td>arp.request.target.ip</td><td>IPv4 address</td><td>ARP target ip Address</td><td>arp.request.target.ip == 192.168.1.10</td><td></td></tr><tr><td>arp.request.sender.ip</td><td>IPv4 address</td><td>ARP sender ip Address</td><td>arp.request.sender.ip == 192.168.1.10</td><td>v4.8</td></tr><tr><td>ftp</td><td></td><td>is FTP</td><td>ftp ==</td><td></td></tr><tr><td>regex</td><td></td><td>Regular Expression</td><td>regex == {s}\/.*Host: nlpqflkbvkdde.eu</td><td></td></tr><tr><td>country.iso_code</td><td>Country ISO code (Alpha-2 code)</td><td>is Country flow</td><td>country.iso_code == TW</td><td>Need upload dbip database</td></tr><tr><td>grism.srcport</td><td></td><td>packet comes from which port</td><td>grism.srcport == P0</td><td></td></tr><tr><td>grism.port.linkdown</td><td></td><td>grism port link down</td><td>grism.port.linkdown == P0</td><td></td></tr><tr><td>session.packet.nth</td><td></td><td>the nth packet in flow</td><td>session.packet.nth == 3</td><td></td></tr><tr><td>heartbeat.target.miss.nth</td><td></td><td>heartbeat missed from nth target setting</td><td>heartbeat.target.miss.nth == 1</td><td></td></tr><tr><td>heartbeat.target.miss.id</td><td>int</td><td>heartbeat missed from target id (recommend)</td><td>heartbeat.target.miss.id == 5</td><td>v3.2</td></tr><tr><td>flowtable.matched.fid</td><td></td><td>flow matched which filter id</td><td>flowtable.matched.fid == F1</td><td></td></tr><tr><td>flowtable.inport</td><td></td><td>flow comes from which port</td><td>flowtable.inport == P0</td><td></td></tr><tr><td>1</td><td>Unsigned integer, 4 byte</td><td>true or false</td><td>1 != 1</td><td></td></tr><tr><td>packet.len</td><td>int</td><td>packet length</td><td>packet.len >= 500</td><td>v3.9</td></tr></tbody></table>

## Example

```xml
<filter id="1">
  <or>
    <find id="1" name="ip.addr" relation="==" content="8.8.8.8" />
    <find id="2" name="ip.addr" relation="==" content="2.2.2.2" />
  </or>
</filter>
```

```xml
<filter id="1">
  <or>
    <f n="ip.addr" r="==" c="8.8.8.8" />
    <f n="ip.addr" r="==" c="2.2.2.2" />
  </or>
</filter>
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://arraynetworks.gitbook.io/array-xml/readme/filter/find.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.