> For the complete documentation index, see [llms.txt](https://arraynetworks.gitbook.io/array-xml/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://arraynetworks.gitbook.io/array-xml/readme/filter/find.md).

# Element \<find>

Defines the find(f). It has a start tag \<find> or \<f>

## Attribute

<table><thead><tr><th width="150">Attribute</th><th width="150">Alternative</th><th width="215">Description</th><th width="156">Type</th><th>Default (* must have)</th></tr></thead><tbody><tr><td>id</td><td></td><td>Specifies a unique id for an element</td><td>Interger</td><td></td></tr><tr><td>name</td><td>n</td><td>refer to wireshark filter function, but less item</td><td>String</td><td>*</td></tr><tr><td>relation</td><td>r</td><td>Equal or Not equal</td><td><p>==/!=</p><p>>=/&#x3C;= (v3.9)</p></td><td>*</td></tr><tr><td>content</td><td>c</td><td>content of name, could be empty</td><td>String</td><td>*</td></tr></tbody></table>

### Attribute -name

<table><thead><tr><th width="151.32440213813035">name</th><th width="177">type</th><th width="166.61725067385444">Description</th><th width="175">Example</th><th>Support</th></tr></thead><tbody><tr><td>eth.addr</td><td>MAC address</td><td>Source or Destination MAC address</td><td>eth.addr == 12:34:56:78:9a:bc</td><td></td></tr><tr><td>eth.src</td><td>MAC address</td><td>Source MAC address</td><td>eth.src == 12:34:56:78:9a:bc</td><td></td></tr><tr><td>eth.dst</td><td>MAC address</td><td>Destination MAC address</td><td>eth.dst == 12:34:56:78:9a:bc</td><td></td></tr><tr><td>eth.type</td><td>Unsigned integer, 2 bytes</td><td>EtherType</td><td>eth.type == 2048 (IPv4 0x0800)</td><td></td></tr><tr><td>vlan.id</td><td>Unsigned integer, 2 bytes</td><td>vlan id</td><td>vlan.id == 5</td><td></td></tr><tr><td>vlan.l2.id</td><td>Unsigned integer, 2 bytes</td><td>vlan layer 2 id</td><td>vlan.l2.id == 1</td><td></td></tr><tr><td>vlan.priority</td><td>Unsigned integer, 2 bytes</td><td>Priority</td><td>vlan.priority == 5</td><td></td></tr><tr><td>ip</td><td></td><td>is IPv4</td><td>ip ==</td><td></td></tr><tr><td>ip.addr</td><td>IPv4 address</td><td>Source or Destination Address</td><td>ip.addr == 8.8.8.8</td><td></td></tr><tr><td>ip.src</td><td>IPv4 address</td><td>Source Address</td><td>ip.src == 8.8.8.8</td><td></td></tr><tr><td>ip.dst</td><td>IPv4 address</td><td>Destination Address</td><td>ip.dst == 8.8.8.8</td><td></td></tr><tr><td>ip.proto</td><td>Unsigned integer, 1 byte</td><td>Protocol</td><td>ip.proto == 6 (TCP)</td><td></td></tr><tr><td>ip.fragment</td><td></td><td>is IPv4 Fragment</td><td>ip.fragment ==</td><td></td></tr><tr><td>ip.flags.df</td><td>Unsigned integer, 1 byte</td><td>is IP don't fragment</td><td>ip.flags.df == 1</td><td>v3.9</td></tr><tr><td>ip.flags.mf</td><td>Unsigned integer, 1 byte</td><td>is IP more fragment</td><td>ip.flags.mf == 1</td><td>v3.9</td></tr><tr><td>ip.dsfield</td><td>Unsigned integer, 1 byte</td><td>Differentiated Services Field</td><td>ip.dsfield == 1</td><td></td></tr><tr><td>ipv6</td><td></td><td>is IPv6</td><td>ipv6 ==</td><td></td></tr><tr><td>ipv6.addr</td><td>IPv6 address</td><td>Source or Destination Address</td><td>ipv6.addr == 2001:0db8:86a3:08d3:1319:8a2e:0370:7344</td><td></td></tr><tr><td>ipv6.src</td><td>IPv6 address</td><td>Source Address</td><td>ipv6.src == 2001:0db8:86a3:08d3:1319:8a2e:0370:7344</td><td></td></tr><tr><td>ipv6.dst</td><td>IPv6 address</td><td>Destination Address</td><td>ipv6.dst == 2001:0db8:86a3:08d3:1319:8a2e:0370:7344</td><td></td></tr><tr><td>ipv6.nxt</td><td>Unsigned integer, 1 byte</td><td>Next Header</td><td></td><td></td></tr><tr><td>tcp</td><td></td><td>is TCP</td><td>tcp ==</td><td></td></tr><tr><td>tcp.port</td><td>Unsigned integer, 2 bytes</td><td>Source or Destination Port</td><td>tcp.port == 443</td><td></td></tr><tr><td>tcp.srcport</td><td>Unsigned integer, 2 bytes</td><td>Source Port</td><td>tcp.srcport == 443</td><td></td></tr><tr><td>tcp.dstport</td><td>Unsigned integer, 2 bytes</td><td>Destination Port</td><td>tcp.dstport == 443</td><td></td></tr><tr><td>tcp.flags.syn</td><td>0 or 1</td><td>Syn</td><td>tcp.flags.syn == 1</td><td></td></tr><tr><td>tcp.flags.ack</td><td>0 or 1</td><td>Ack</td><td>tcp.flags.ack == 1</td><td></td></tr><tr><td>tcp.flags.fin</td><td>0 or 1</td><td>Fin</td><td>tcp.flags.fin == 1</td><td></td></tr><tr><td>tcp.flags.reset</td><td>0 or 1</td><td>Reset</td><td>tcp.flags.rst == 1</td><td></td></tr><tr><td>udp</td><td></td><td>is UDP</td><td>udp ==</td><td></td></tr><tr><td>udp.port</td><td>Unsigned integer, 2 bytes</td><td>Source or Destination Port</td><td>udp.port == 53</td><td></td></tr><tr><td>udp.srcport</td><td>Unsigned integer, 2 bytes</td><td>Source Port</td><td>udp.srcport == 53</td><td></td></tr><tr><td>udp.dstport</td><td>Unsigned integer, 2 bytes</td><td>Destination Port</td><td>udp.dstport == 53</td><td></td></tr><tr><td>sctp</td><td></td><td>is SCTP</td><td>sctp ==</td><td></td></tr><tr><td>sctp.port</td><td>Unsigned integer, 2 bytes</td><td>Source or Destination Port</td><td>sctp.port == 2906</td><td></td></tr><tr><td>sctp.srcport</td><td>Unsigned integer, 2 bytes</td><td>Source Port</td><td>sctp.srcport == 2906</td><td></td></tr><tr><td>sctp.dstport</td><td>Unsigned integer, 2 bytes</td><td>Destination Port</td><td>sctp.dstport == 2906</td><td></td></tr><tr><td>5-tuple</td><td>5 Tuple, - means don't care</td><td>Source IP Address, Destination IP Address, Protocol, Source Port, Destination Port</td><td>5-tuple == - 192.168.1.203 - - 443</td><td></td></tr><tr><td>gtp.cp</td><td></td><td></td><td></td><td></td></tr><tr><td>gtp.data</td><td></td><td></td><td></td><td></td></tr><tr><td>gtp.imsi</td><td></td><td></td><td></td><td></td></tr><tr><td>gtp.teid</td><td></td><td></td><td></td><td></td></tr><tr><td>ip.addr.related.gtp.imsi</td><td></td><td></td><td>ip.addr.related.gtp.imsi == 466100000001007</td><td></td></tr><tr><td>gre</td><td></td><td>is GRE</td><td>gre ==</td><td></td></tr><tr><td>vxlan</td><td></td><td>is VXLAN</td><td>vxlan ==</td><td>v5.2</td></tr><tr><td>vxlan.vni</td><td>Unsigned integer, 3 bytes</td><td>VXLAN vni</td><td>vxlan.vni == 1</td><td>v5.2</td></tr><tr><td>erspan.spanid</td><td></td><td>ERSPAN id</td><td>erspan.spanid == 1</td><td></td></tr><tr><td>voip</td><td></td><td>is SIP or RTP</td><td>voip ==</td><td></td></tr><tr><td>voip.account</td><td></td><td></td><td>voip.account == 212@o.gentrice.net</td><td></td></tr><tr><td>voip.from</td><td></td><td></td><td>voip.from == 212@o.gentrice.net</td><td></td></tr><tr><td>voip.to</td><td></td><td></td><td>voip.to == 212@o.gentrice.net</td><td></td></tr><tr><td>dns.a</td><td>IPv4 address</td><td>DNS type A ip addresses</td><td>dns.a == 216.239.32.10</td><td></td></tr><tr><td>dns.flags.response</td><td>0 or 1</td><td>DNS Response</td><td>dns.flags.response == 1</td><td></td></tr><tr><td>dns.count.add_rr</td><td>int</td><td>DNS additional records count</td><td>dns.count.add_rr == 1</td><td></td></tr><tr><td>dns.qry.type</td><td>int</td><td>DNS query type</td><td>dns.qry.type == 1</td><td></td></tr><tr><td>dns.qry.name</td><td>Character string</td><td>DNS query name</td><td>dns.qry.name == google.com</td><td></td></tr><tr><td>dns.qry.name_public_suffix</td><td>Character string</td><td>DNS query name public suffix</td><td>dns.qry.name_public_suffix == *.googlevideo.com</td><td></td></tr><tr><td>dns.qry.name.resp.ip.addr</td><td>Character string</td><td>DNS query name response ip addr</td><td>dns.qry.name.resp.ip.addr == googlevideo.com</td><td></td></tr><tr><td>http</td><td></td><td>is HTTP</td><td>http ==</td><td></td></tr><tr><td>http.request</td><td></td><td>is HTTP request</td><td>http.request ==</td><td></td></tr><tr><td>http.host</td><td>Character string</td><td>HTTP host</td><td>http.host == yahoo.com</td><td>v5.3</td></tr><tr><td>http.request.uri</td><td>Character string</td><td>HTTP request uri</td><td>http.request.uri == /index.html</td><td>v5.3</td></tr><tr><td>http.request.method</td><td>GET,HEAD,POST,etc.</td><td>HTTP request method</td><td>http.request.method == GET</td><td></td></tr><tr><td>http.request.url</td><td>url</td><td>HTTP request url</td><td>http.request.url == www.whitehollowtransport.com/current-elliott-c-89.html</td><td></td></tr><tr><td>ssl</td><td></td><td>is SSL</td><td>ssl ==</td><td></td></tr><tr><td>ssl.server_name</td><td>Character string</td><td>SSL server_name</td><td>ssl.server_name == facebook.com</td><td></td></tr><tr><td>ssl.server_name_public_suffix</td><td>Character string</td><td>SSL server_name public suffix</td><td>ssl.server_name_public_suffix == *.googlevideo.com</td><td></td></tr><tr><td>ssl.handshake.type</td><td>0 or 1</td><td>SSL handshake type</td><td>ssl.handshake.type == 1</td><td></td></tr><tr><td>ssl.ja3_digest</td><td></td><td>SSL ja3 digest</td><td>ssl.ja3_digest == 39e62db039deed96a9daf75dacdbd207</td><td></td></tr><tr><td>ssl.ja3s_digest</td><td></td><td>SSL ja3s digest</td><td>ssl.ja3s_digest == 15af977ce25de452b96affa2addb1036</td><td>v5.3</td></tr><tr><td>arp</td><td></td><td>is ARP</td><td>arp ==</td><td></td></tr><tr><td>arp.request</td><td></td><td>is ARP request</td><td>arp.request ==</td><td></td></tr><tr><td>arp.reply</td><td></td><td>is ARP reply</td><td>arp.reply ==</td><td></td></tr><tr><td>arp.request.target.ip</td><td>IPv4 address</td><td>ARP target ip Address</td><td>arp.request.target.ip == 192.168.1.10</td><td></td></tr><tr><td>arp.request.sender.ip</td><td>IPv4 address</td><td>ARP sender ip Address</td><td>arp.request.sender.ip == 192.168.1.10</td><td>v4.8</td></tr><tr><td>ftp</td><td></td><td>is FTP</td><td>ftp ==</td><td></td></tr><tr><td>regex</td><td></td><td>Regular Expression</td><td>regex == {s}\/.*Host: nlpqflkbvkdde.eu</td><td></td></tr><tr><td>country.iso_code</td><td>Country ISO code (Alpha-2 code)</td><td>is Country flow</td><td>country.iso_code == TW</td><td>Need upload dbip database</td></tr><tr><td>grism.srcport</td><td></td><td>packet comes from which port</td><td>grism.srcport == P0</td><td></td></tr><tr><td>grism.port.linkdown</td><td></td><td>grism port link down</td><td>grism.port.linkdown == P0</td><td></td></tr><tr><td>session.packet.nth</td><td></td><td>the nth packet in flow</td><td>session.packet.nth == 3</td><td></td></tr><tr><td>heartbeat.target.miss.nth</td><td></td><td>heartbeat missed from nth target setting</td><td>heartbeat.target.miss.nth == 1</td><td></td></tr><tr><td>heartbeat.target.miss.id</td><td>int</td><td>heartbeat missed from target id (recommend)</td><td>heartbeat.target.miss.id == 5</td><td>v3.2</td></tr><tr><td>flowtable.matched.fid</td><td></td><td>flow matched which filter id</td><td>flowtable.matched.fid == F1</td><td></td></tr><tr><td>flowtable.inport</td><td></td><td>flow comes from which port</td><td>flowtable.inport == P0</td><td></td></tr><tr><td>1</td><td>Unsigned integer, 4 byte</td><td>true or false</td><td>1 != 1</td><td></td></tr><tr><td>packet.len</td><td>int</td><td>packet length</td><td>packet.len >= 500</td><td>v3.9</td></tr></tbody></table>

## Example

```xml
<filter id="1">
  <or>
    <find id="1" name="ip.addr" relation="==" content="8.8.8.8" />
    <find id="2" name="ip.addr" relation="==" content="2.2.2.2" />
  </or>
</filter>
```

```xml
<filter id="1">
  <or>
    <f n="ip.addr" r="==" c="8.8.8.8" />
    <f n="ip.addr" r="==" c="2.2.2.2" />
  </or>
</filter>
```