# Examples that match MAC (a big "thank you" to Julian Anastasov for this!):
M0 through M5 are the 6 bytes of the MAC address.
Egress (match destination MAC):
tc filter add dev eth1 parent 1: protocol ip prio 5 u32 match u16
0x0800 0xffff at -2 match u32 0xM2M3M4M5 0xffffffff at -12 match u16
0xM0M1 0xffff at -14 flowid 1:40
Ingress (match source MAC):
tc filter add dev eth1 parent 1: protocol ip prio 5 u32 match u16
0x0800 0xffff at -2 match u16 0xM4M5 0xffff at -4 match u32
0xM0M1M2M3 0xffffffff at -8 flowid 1:40
# Example that matches ARP (a big "thank you" to Martin Brown for this!):
# dst MAC is 6 bytes at -14
# src MAC is 6 bytes at -8
# the ARP protocol is 2 bytes at -2
# the "0806" comes from linux/include/linux/if_ether.h
tc filter add dev $DEV parent 1: protocol ip prio 5 u32
match u16 0x0806 0xffff at -2 flowid 1:50