There probably are a couple of simple conditions that could benefit from an alias / shorthand to reduce typing / complexity:
In addition it would be helpful to support expansion macros for e.g. interface IPs in conditions, so that the condition could automatically limit results to flows seen with the interface IP as src / dst:
dip = @LOCAL in conjunction with -i <interface_pattern>
Important: The DeMorgan rules have to be honored, especially for the first item.
There probably are a couple of simple conditions that could benefit from an alias / shorthand to reduce typing / complexity:
RFC1918(private network ranges):(net eq rfc1918)/(net eq private)->(net eq 10.0.0.0/8 or net eq 172.16.0.0/12 or net eq 192.168.0.0/16)INexpansion:<attribute> IN a,b,...-><attribute> eq a or <attribute> eq b ...In addition it would be helpful to support expansion macros for e.g. interface IPs in conditions, so that the condition could automatically limit results to flows seen with the interface IP as src / dst:
dip = @LOCALin conjunction with-i <interface_pattern>Important: The DeMorgan rules have to be honored, especially for the first item.