/usr/bin/arptables-nft

arptables v1.8.13 (nf_tables)

Usage: arptables -[ACD] chain rule-specification [options]
       arptables -I chain [rulenum] rule-specification [options]
       arptables -R chain rulenum rule-specification [options]
       arptables -D chain rulenum [options]
       arptables -[LS] [chain [rulenum]] [options]
       arptables -[FZ] [chain] [options]
       arptables -[NX] chain
       arptables -E old-chain-name new-chain-name
       arptables -P chain target [options]
       arptables -h (print this help information)

Commands:
Either long or short options are allowed.
  --append  -A chain		Append to chain
  --check   -C chain		Check for the existence of a rule
  --delete  -D chain		Delete matching rule from chain
  --delete  -D chain rulenum
				Delete rule rulenum (1 = first) from chain
  --insert  -I chain [rulenum]
				Insert in chain as rulenum (default 1=first)
  --replace -R chain rulenum
				Replace rule rulenum (1 = first) in chain
  --list    -L [chain [rulenum]]
				List the rules in a chain or all chains
  --list-rules -S [chain [rulenum]]
				Print the rules in a chain or all chains
  --flush   -F [chain]		Delete all rules in  chain or all chains
  --zero    -Z [chain [rulenum]]
				Zero counters in chain or all chains
  --new     -N chain		Create a new user-defined chain
  --delete-chain
            -X [chain]		Delete a user-defined chain
  --policy  -P chain target
				Change policy on chain to target
  --rename-chain
            -E old-chain new-chain
				Change chain name, (moving any references)

Options:
[!] --source-ip	-s address[/mask]
				source specification
[!] --destination-ip -d address[/mask]
				destination specification
[!] --source-mac address[/mask]
[!] --destination-mac address[/mask]
    --h-length   -l   length[/mask] hardware length (nr of bytes)
    --opcode code[/mask] operation code (2 bytes)
    --h-type   type[/mask]  hardware type (2 bytes, hexadecimal)
    --proto-type   type[/mask]  protocol type (2 bytes)
[!] --in-interface -i input name[+]
				network interface name ([+] for wildcard)
 --jump	-j target
				target for rule (may load target extension)
  --match	-m match
				extended match (may load extension)
  --numeric	-n		numeric output of addresses and ports
[!] --out-interface -o output name[+]
				network interface name ([+] for wildcard)
  --table	-t table	table to manipulate (default: `filter')
  --verbose	-v		verbose mode
  --wait	-w [seconds]	maximum wait to acquire xtables lock before give up
  --line-numbers		print line numbers when listing
  --exact	-x		expand numbers (display exact values)
  --modprobe=<command>		try to insert modules using this command
  --set-counters -c PKTS BYTES	set the counter during insert/append
[!] --version	-V		print package version.
 opcode strings:
 1 = Request
 2 = Reply
 3 = Request_Reverse
 4 = Reply_Reverse
 5 = DRARP_Request
 6 = DRARP_Reply
 7 = DRARP_Error
 8 = InARP_Request
 9 = ARP_NAK
 hardware type string: 1 = Ethernet
 protocol type string: 0x800 = IPv4

MARK target options:
  --set-xmark value[/mask]  Clear bits in mask and XOR value into nfmark
  --set-mark value[/mask]   Clear bits in mask and OR value into nfmark
  --and-mark bits           Binary AND the nfmark with bits
  --or-mark bits            Binary OR the nfmark with bits
  --xor-mark bits           Binary XOR the nfmark with bits

CLASSIFY target options:
--set-class MAJOR:MINOR    Set skb->priority value (always hexadecimal!)

mangle target options:
--mangle-ip-s IP address
--mangle-ip-d IP address
--mangle-mac-s MAC address
--mangle-mac-d MAC address
--mangle-target target (DROP, CONTINUE or ACCEPT -- default is ACCEPT)

standard match options:
(If target is DROP, ACCEPT, RETURN or nothing)