Filter match: Flexible Offset

Using Flexible-match-mask and flexible-match-range variants, firewall filters can be constructed that start the match at layer-2, layer-3, layer-4, or payload locations. From there, additional offset criteria can be specified thereby enabling pattern matches at custom, user-defined locations within a packet.