# tcp dport 22 iiftype ether ip daddr 1.2.3.4 ether saddr 00:0f:54:0c:11:4 accept
[
    {
        "match": {
            "left": {
                "payload": {
                    "field": "dport",
                    "protocol": "tcp"
                }
            },
            "op": "==",
            "right": 22
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "daddr",
                    "protocol": "ip"
                }
            },
            "op": "==",
            "right": "1.2.3.4"
        }
    },
    {
        "match": {
            "left": {
                "payload": {
                    "field": "saddr",
                    "protocol": "ether"
                }
            },
            "op": "==",
            "right": "00:0f:54:0c:11:04"
        }
    },
    {
        "accept": null
    }
]