+
+Toggling isolated mode
+~~~~~~~~~~~~~~~~~~~~~~
+
+``flow isolate`` can be used to tell the underlying PMD that ingress traffic
+must only be injected from the defined flow rules; that no default traffic
+is expected outside those rules and the driver is free to assign more
+resources to handle them. It is bound to ``rte_flow_isolate()``::
+
+ flow isolate {port_id} {boolean}
+
+If successful, enabling or disabling isolated mode shows either::
+
+ Ingress traffic on port [...]
+ is now restricted to the defined flow rules
+
+Or::
+
+ Ingress traffic on port [...]
+ is not restricted anymore to the defined flow rules
+
+Otherwise, in case of error::
+
+ Caught error type [...] ([...]): [...]
+
+Mainly due to its side effects, PMDs supporting this mode may not have the
+ability to toggle it more than once without reinitializing affected ports
+first (e.g. by exiting testpmd).
+
+Enabling isolated mode::
+
+ testpmd> flow isolate 0 true
+ Ingress traffic on port 0 is now restricted to the defined flow rules
+ testpmd>
+
+Disabling isolated mode::
+
+ testpmd> flow isolate 0 false
+ Ingress traffic on port 0 is not restricted anymore to the defined flow rules
+ testpmd>
+
+Dumping HW internal information
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+``flow dump`` dumps the hardware's internal representation information of
+all flows. It is bound to ``rte_flow_dev_dump()``::
+
+ flow dump {port_id} {output_file}
+
+If successful, it will show::
+
+ Flow dump finished
+
+Otherwise, it will complain error occurred::
+
+ Caught error type [...] ([...]): [...]
+
+Listing and destroying aged flow rules
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+``flow aged`` simply lists aged flow rules be get from api ``rte_flow_get_aged_flows``,
+and ``destroy`` parameter can be used to destroy those flow rules in PMD.
+
+ flow aged {port_id} [destroy]
+
+Listing current aged flow rules::
+
+ testpmd> flow aged 0
+ Port 0 total aged flows: 0
+ testpmd> flow create 0 ingress pattern eth / ipv4 src is 2.2.2.14 / end
+ actions age timeout 5 / queue index 0 / end
+ Flow rule #0 created
+ testpmd> flow create 0 ingress pattern eth / ipv4 src is 2.2.2.15 / end
+ actions age timeout 4 / queue index 0 / end
+ Flow rule #1 created
+ testpmd> flow create 0 ingress pattern eth / ipv4 src is 2.2.2.16 / end
+ actions age timeout 2 / queue index 0 / end
+ Flow rule #2 created
+ testpmd> flow create 0 ingress pattern eth / ipv4 src is 2.2.2.17 / end
+ actions age timeout 3 / queue index 0 / end
+ Flow rule #3 created
+
+
+Aged Rules are simply list as command ``flow list {port_id}``, but strip the detail rule
+information, all the aged flows are sorted by the longest timeout time. For example, if
+those rules be configured in the same time, ID 2 will be the first aged out rule, the next
+will be ID 3, ID 1, ID 0::
+
+ testpmd> flow aged 0
+ Port 0 total aged flows: 4
+ ID Group Prio Attr
+ 2 0 0 i--
+ 3 0 0 i--
+ 1 0 0 i--
+ 0 0 0 i--
+
+If attach ``destroy`` parameter, the command will destroy all the list aged flow rules.
+
+ testpmd> flow aged 0 destroy
+ Port 0 total aged flows: 4
+ ID Group Prio Attr
+ 2 0 0 i--
+ 3 0 0 i--
+ 1 0 0 i--
+ 0 0 0 i--
+
+ Flow rule #2 destroyed
+ Flow rule #3 destroyed
+ Flow rule #1 destroyed
+ Flow rule #0 destroyed
+ 4 flows be destroyed
+ testpmd> flow aged 0
+ Port 0 total aged flows: 0
+
+Creating indirect actions
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+``flow indirect_action {port_id} create`` creates indirect action with optional
+indirect action ID. It is bound to ``rte_flow_action_handle_create()``::
+
+ flow indirect_action {port_id} create [action_id {indirect_action_id}]
+ [ingress] [egress] [transfer] action {action} / end
+
+If successful, it will show::
+
+ Indirect action #[...] created
+
+Otherwise, it will complain either that indirect action already exists or that
+some error occurred::
+
+ Indirect action #[...] is already assigned, delete it first
+
+::
+
+ Caught error type [...] ([...]): [...]
+
+Create indirect rss action with id 100 to queues 1 and 2 on port 0::
+
+ testpmd> flow indirect_action 0 create action_id 100 \
+ ingress action rss queues 1 2 end / end
+
+Create indirect rss action with id assigned by testpmd to queues 1 and 2 on
+port 0::
+
+ testpmd> flow indirect_action 0 create action_id \
+ ingress action rss queues 0 1 end / end
+
+Updating indirect actions
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+``flow indirect_action {port_id} update`` updates configuration of the indirect
+action from its indirect action ID (as returned by
+``flow indirect_action {port_id} create``). It is bound to
+``rte_flow_action_handle_update()``::
+
+ flow indirect_action {port_id} update {indirect_action_id}
+ action {action} / end
+
+If successful, it will show::
+
+ Indirect action #[...] updated
+
+Otherwise, it will complain either that indirect action not found or that some
+error occurred::
+
+ Failed to find indirect action #[...] on port [...]
+
+::
+
+ Caught error type [...] ([...]): [...]
+
+Update indirect rss action having id 100 on port 0 with rss to queues 0 and 3
+(in create example above rss queues were 1 and 2)::
+
+ testpmd> flow indirect_action 0 update 100 action rss queues 0 3 end / end
+
+Destroying indirect actions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+``flow indirect_action {port_id} destroy`` destroys one or more indirect actions
+from their indirect action IDs (as returned by
+``flow indirect_action {port_id} create``). It is bound to
+``rte_flow_action_handle_destroy()``::
+
+ flow indirect_action {port_id} destroy action_id {indirect_action_id} [...]
+
+If successful, it will show::
+
+ Indirect action #[...] destroyed
+
+It does not report anything for indirect action IDs that do not exist.
+The usual error message is shown when a indirect action cannot be destroyed::
+
+ Caught error type [...] ([...]): [...]
+
+Destroy indirect actions having id 100 & 101::
+
+ testpmd> flow indirect_action 0 destroy action_id 100 action_id 101
+
+Query indirect actions
+~~~~~~~~~~~~~~~~~~~~~~
+
+``flow indirect_action {port_id} query`` queries the indirect action from its
+indirect action ID (as returned by ``flow indirect_action {port_id} create``).
+It is bound to ``rte_flow_action_handle_query()``::
+
+ flow indirect_action {port_id} query {indirect_action_id}
+
+Currently only rss indirect action supported. If successful, it will show::
+
+ Indirect RSS action:
+ refs:[...]
+
+Otherwise, it will complain either that indirect action not found or that some
+error occurred::
+
+ Failed to find indirect action #[...] on port [...]
+
+::
+
+ Caught error type [...] ([...]): [...]
+
+Query indirect action having id 100::
+
+ testpmd> flow indirect_action 0 query 100
+
+Sample QinQ flow rules
+~~~~~~~~~~~~~~~~~~~~~~
+
+Before creating QinQ rule(s) the following commands should be issued to enable QinQ::
+
+ testpmd> port stop 0
+ testpmd> vlan set extend on 0
+
+The above command sets the inner and outer TPID's to 0x8100.
+
+To change the TPID's the following commands should be used::
+
+ testpmd> vlan set outer tpid 0x88A8 0
+ testpmd> vlan set inner tpid 0x8100 0
+ testpmd> port start 0
+
+Validate and create a QinQ rule on port 0 to steer traffic to a VF queue in a VM.
+
+::
+
+ testpmd> flow validate 0 ingress pattern eth / vlan tci is 123 /
+ vlan tci is 456 / end actions vf id 1 / queue index 0 / end
+ Flow rule #0 validated
+
+ testpmd> flow create 0 ingress pattern eth / vlan tci is 4 /
+ vlan tci is 456 / end actions vf id 123 / queue index 0 / end
+ Flow rule #0 created
+
+ testpmd> flow list 0
+ ID Group Prio Attr Rule
+ 0 0 0 i- ETH VLAN VLAN=>VF QUEUE
+
+Validate and create a QinQ rule on port 0 to steer traffic to a queue on the host.
+
+::
+
+ testpmd> flow validate 0 ingress pattern eth / vlan tci is 321 /
+ vlan tci is 654 / end actions pf / queue index 0 / end
+ Flow rule #1 validated
+
+ testpmd> flow create 0 ingress pattern eth / vlan tci is 321 /
+ vlan tci is 654 / end actions pf / queue index 1 / end
+ Flow rule #1 created
+
+ testpmd> flow list 0
+ ID Group Prio Attr Rule
+ 0 0 0 i- ETH VLAN VLAN=>VF QUEUE
+ 1 0 0 i- ETH VLAN VLAN=>PF QUEUE
+
+Sample VXLAN flow rules
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Before creating VXLAN rule(s), the UDP port should be added for VXLAN packet
+filter on a port::
+
+ testpmd> rx_vxlan_port add 4789 0
+
+Create VXLAN rules on port 0 to steer traffic to PF queues.
+
+::
+
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / vxlan /
+ eth dst is 00:11:22:33:44:55 / end actions pf / queue index 1 / end
+ Flow rule #0 created
+
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / vxlan vni is 3 /
+ eth dst is 00:11:22:33:44:55 / end actions pf / queue index 2 / end
+ Flow rule #1 created
+
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / vxlan /
+ eth dst is 00:11:22:33:44:55 / vlan tci is 10 / end actions pf /
+ queue index 3 / end
+ Flow rule #2 created
+
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / vxlan vni is 5 /
+ eth dst is 00:11:22:33:44:55 / vlan tci is 20 / end actions pf /
+ queue index 4 / end
+ Flow rule #3 created
+
+ testpmd> flow create 0 ingress pattern eth dst is 00:00:00:00:01:00 / ipv4 /
+ udp / vxlan vni is 6 / eth dst is 00:11:22:33:44:55 / end actions pf /
+ queue index 5 / end
+ Flow rule #4 created
+
+ testpmd> flow list 0
+ ID Group Prio Attr Rule
+ 0 0 0 i- ETH IPV4 UDP VXLAN ETH => QUEUE
+ 1 0 0 i- ETH IPV4 UDP VXLAN ETH => QUEUE
+ 2 0 0 i- ETH IPV4 UDP VXLAN ETH VLAN => QUEUE
+ 3 0 0 i- ETH IPV4 UDP VXLAN ETH VLAN => QUEUE
+ 4 0 0 i- ETH IPV4 UDP VXLAN ETH => QUEUE
+
+Sample VXLAN encapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+VXLAN encapsulation outer layer has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+IPv4 VXLAN outer header::
+
+ testpmd> set vxlan ip-version ipv4 vni 4 udp-src 4 udp-dst 4 ip-src 127.0.0.1
+ ip-dst 128.0.0.1 eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions vxlan_encap /
+ queue index 0 / end
+
+ testpmd> set vxlan-with-vlan ip-version ipv4 vni 4 udp-src 4 udp-dst 4 ip-src
+ 127.0.0.1 ip-dst 128.0.0.1 vlan-tci 34 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions vxlan_encap /
+ queue index 0 / end
+
+ testpmd> set vxlan-tos-ttl ip-version ipv4 vni 4 udp-src 4 udp-dst 4 ip-tos 0
+ ip-ttl 255 ip-src 127.0.0.1 ip-dst 128.0.0.1 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions vxlan_encap /
+ queue index 0 / end
+
+IPv6 VXLAN outer header::
+
+ testpmd> set vxlan ip-version ipv6 vni 4 udp-src 4 udp-dst 4 ip-src ::1
+ ip-dst ::2222 eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions vxlan_encap /
+ queue index 0 / end
+
+ testpmd> set vxlan-with-vlan ip-version ipv6 vni 4 udp-src 4 udp-dst 4
+ ip-src ::1 ip-dst ::2222 vlan-tci 34 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions vxlan_encap /
+ queue index 0 / end
+
+ testpmd> set vxlan-tos-ttl ip-version ipv6 vni 4 udp-src 4 udp-dst 4
+ ip-tos 0 ip-ttl 255 ::1 ip-dst ::2222 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions vxlan_encap /
+ queue index 0 / end
+
+Sample NVGRE encapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+NVGRE encapsulation outer layer has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+IPv4 NVGRE outer header::
+
+ testpmd> set nvgre ip-version ipv4 tni 4 ip-src 127.0.0.1 ip-dst 128.0.0.1
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions nvgre_encap /
+ queue index 0 / end
+
+ testpmd> set nvgre-with-vlan ip-version ipv4 tni 4 ip-src 127.0.0.1
+ ip-dst 128.0.0.1 vlan-tci 34 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions nvgre_encap /
+ queue index 0 / end
+
+IPv6 NVGRE outer header::
+
+ testpmd> set nvgre ip-version ipv6 tni 4 ip-src ::1 ip-dst ::2222
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions nvgre_encap /
+ queue index 0 / end
+
+ testpmd> set nvgre-with-vlan ip-version ipv6 tni 4 ip-src ::1 ip-dst ::2222
+ vlan-tci 34 eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern end actions nvgre_encap /
+ queue index 0 / end
+
+Sample L2 encapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+L2 encapsulation has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+L2 header::
+
+ testpmd> set l2_encap ip-version ipv4
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / mpls / end actions
+ mplsoudp_decap / l2_encap / end
+
+L2 with VXLAN header::
+
+ testpmd> set l2_encap-with-vlan ip-version ipv4 vlan-tci 34
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / mpls / end actions
+ mplsoudp_decap / l2_encap / end
+
+Sample L2 decapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+L2 decapsulation has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+L2 header::
+
+ testpmd> set l2_decap
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap / mplsoudp_encap /
+ queue index 0 / end
+
+L2 with VXLAN header::
+
+ testpmd> set l2_encap-with-vlan
+ testpmd> flow create 0 egress pattern eth / end actions l2_encap / mplsoudp_encap /
+ queue index 0 / end
+
+Sample MPLSoGRE encapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+MPLSoGRE encapsulation outer layer has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+IPv4 MPLSoGRE outer header::
+
+ testpmd> set mplsogre_encap ip-version ipv4 label 4
+ ip-src 127.0.0.1 ip-dst 128.0.0.1 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsogre_encap / end
+
+IPv4 MPLSoGRE with VLAN outer header::
+
+ testpmd> set mplsogre_encap-with-vlan ip-version ipv4 label 4
+ ip-src 127.0.0.1 ip-dst 128.0.0.1 vlan-tci 34
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsogre_encap / end
+
+IPv6 MPLSoGRE outer header::
+
+ testpmd> set mplsogre_encap ip-version ipv6 mask 4
+ ip-src ::1 ip-dst ::2222 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsogre_encap / end
+
+IPv6 MPLSoGRE with VLAN outer header::
+
+ testpmd> set mplsogre_encap-with-vlan ip-version ipv6 mask 4
+ ip-src ::1 ip-dst ::2222 vlan-tci 34
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsogre_encap / end
+
+Sample MPLSoGRE decapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+MPLSoGRE decapsulation outer layer has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+IPv4 MPLSoGRE outer header::
+
+ testpmd> set mplsogre_decap ip-version ipv4
+ testpmd> flow create 0 ingress pattern eth / ipv4 / gre / mpls / end actions
+ mplsogre_decap / l2_encap / end
+
+IPv4 MPLSoGRE with VLAN outer header::
+
+ testpmd> set mplsogre_decap-with-vlan ip-version ipv4
+ testpmd> flow create 0 ingress pattern eth / vlan / ipv4 / gre / mpls / end
+ actions mplsogre_decap / l2_encap / end
+
+IPv6 MPLSoGRE outer header::
+
+ testpmd> set mplsogre_decap ip-version ipv6
+ testpmd> flow create 0 ingress pattern eth / ipv6 / gre / mpls / end
+ actions mplsogre_decap / l2_encap / end
+
+IPv6 MPLSoGRE with VLAN outer header::
+
+ testpmd> set mplsogre_decap-with-vlan ip-version ipv6
+ testpmd> flow create 0 ingress pattern eth / vlan / ipv6 / gre / mpls / end
+ actions mplsogre_decap / l2_encap / end
+
+Sample MPLSoUDP encapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+MPLSoUDP encapsulation outer layer has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+IPv4 MPLSoUDP outer header::
+
+ testpmd> set mplsoudp_encap ip-version ipv4 label 4 udp-src 5 udp-dst 10
+ ip-src 127.0.0.1 ip-dst 128.0.0.1 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsoudp_encap / end
+
+IPv4 MPLSoUDP with VLAN outer header::
+
+ testpmd> set mplsoudp_encap-with-vlan ip-version ipv4 label 4 udp-src 5
+ udp-dst 10 ip-src 127.0.0.1 ip-dst 128.0.0.1 vlan-tci 34
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsoudp_encap / end
+
+IPv6 MPLSoUDP outer header::
+
+ testpmd> set mplsoudp_encap ip-version ipv6 mask 4 udp-src 5 udp-dst 10
+ ip-src ::1 ip-dst ::2222 eth-src 11:11:11:11:11:11
+ eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsoudp_encap / end
+
+IPv6 MPLSoUDP with VLAN outer header::
+
+ testpmd> set mplsoudp_encap-with-vlan ip-version ipv6 mask 4 udp-src 5
+ udp-dst 10 ip-src ::1 ip-dst ::2222 vlan-tci 34
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> flow create 0 egress pattern eth / end actions l2_decap /
+ mplsoudp_encap / end
+
+Sample MPLSoUDP decapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+MPLSoUDP decapsulation outer layer has default value pre-configured in testpmd
+source code, those can be changed by using the following commands
+
+IPv4 MPLSoUDP outer header::
+
+ testpmd> set mplsoudp_decap ip-version ipv4
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / mpls / end actions
+ mplsoudp_decap / l2_encap / end
+
+IPv4 MPLSoUDP with VLAN outer header::
+
+ testpmd> set mplsoudp_decap-with-vlan ip-version ipv4
+ testpmd> flow create 0 ingress pattern eth / vlan / ipv4 / udp / mpls / end
+ actions mplsoudp_decap / l2_encap / end
+
+IPv6 MPLSoUDP outer header::
+
+ testpmd> set mplsoudp_decap ip-version ipv6
+ testpmd> flow create 0 ingress pattern eth / ipv6 / udp / mpls / end
+ actions mplsoudp_decap / l2_encap / end
+
+IPv6 MPLSoUDP with VLAN outer header::
+
+ testpmd> set mplsoudp_decap-with-vlan ip-version ipv6
+ testpmd> flow create 0 ingress pattern eth / vlan / ipv6 / udp / mpls / end
+ actions mplsoudp_decap / l2_encap / end
+
+Sample Raw encapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Raw encapsulation configuration can be set by the following commands
+
+Encapsulating VxLAN::
+
+ testpmd> set raw_encap 4 eth src is 10:11:22:33:44:55 / vlan tci is 1
+ inner_type is 0x0800 / ipv4 / udp dst is 4789 / vxlan vni
+ is 2 / end_set
+ testpmd> flow create 0 egress pattern eth / ipv4 / end actions
+ raw_encap index 4 / end
+
+Sample Raw decapsulation rule
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Raw decapsulation configuration can be set by the following commands
+
+Decapsulating VxLAN::
+
+ testpmd> set raw_decap eth / ipv4 / udp / vxlan / end_set
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / vxlan / eth / ipv4 /
+ end actions raw_decap / queue index 0 / end
+
+Sample ESP rules
+~~~~~~~~~~~~~~~~
+
+ESP rules can be created by the following commands::
+
+ testpmd> flow create 0 ingress pattern eth / ipv4 / esp spi is 1 / end actions
+ queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / esp spi is 1 / end
+ actions queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv6 / esp spi is 1 / end actions
+ queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv6 / udp / esp spi is 1 / end
+ actions queue index 3 / end
+
+Sample AH rules
+~~~~~~~~~~~~~~~~
+
+AH rules can be created by the following commands::
+
+ testpmd> flow create 0 ingress pattern eth / ipv4 / ah spi is 1 / end actions
+ queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv4 / udp / ah spi is 1 / end
+ actions queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv6 / ah spi is 1 / end actions
+ queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv6 / udp / ah spi is 1 / end
+ actions queue index 3 / end
+
+Sample PFCP rules
+~~~~~~~~~~~~~~~~~
+
+PFCP rules can be created by the following commands(s_field need to be 1
+if seid is set)::
+
+ testpmd> flow create 0 ingress pattern eth / ipv4 / pfcp s_field is 0 / end
+ actions queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv4 / pfcp s_field is 1
+ seid is 1 / end actions queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv6 / pfcp s_field is 0 / end
+ actions queue index 3 / end
+ testpmd> flow create 0 ingress pattern eth / ipv6 / pfcp s_field is 1
+ seid is 1 / end actions queue index 3 / end
+
+Sample Sampling/Mirroring rules
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Sample/Mirroring rules can be set by the following commands
+
+NIC-RX Sampling rule, the matched ingress packets and sent to the queue 1,
+and 50% packets are duplicated and marked with 0x1234 and sent to queue 0.
+
+::
+
+ testpmd> set sample_actions 0 mark id 0x1234 / queue index 0 / end
+ testpmd> flow create 0 ingress group 1 pattern eth / end actions
+ sample ratio 2 index 0 / queue index 1 / end
+
+Mirroring rule with port representors (with "transfer" attribute), the matched
+ingress packets with encapsulation header are sent to port id 0, and also
+mirrored the packets and sent to port id 2.
+
+::
+
+ testpmd> set sample_actions 0 port_id id 2 / end
+ testpmd> flow create 1 ingress transfer pattern eth / end actions
+ sample ratio 1 index 0 / raw_encap / port_id id 0 / end
+
+Mirroring rule with port representors (with "transfer" attribute), the matched
+ingress packets are sent to port id 2, and also mirrored the packets with
+encapsulation header and sent to port id 0.
+
+::
+
+ testpmd> set sample_actions 0 raw_encap / port_id id 0 / end
+ testpmd> flow create 0 ingress transfer pattern eth / end actions
+ sample ratio 1 index 0 / port_id id 2 / end
+
+Mirroring rule with port representors (with "transfer" attribute), the matched
+ingress packets are sent to port id 2, and also mirrored the packets with
+VXLAN encapsulation header and sent to port id 0.
+
+::
+
+ testpmd> set vxlan ip-version ipv4 vni 4 udp-src 4 udp-dst 4 ip-src 127.0.0.1
+ ip-dst 128.0.0.1 eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> set sample_actions 0 vxlan_encap / port_id id 0 / end
+ testpmd> flow create 0 ingress transfer pattern eth / end actions
+ sample ratio 1 index 0 / port_id id 2 / end
+
+Mirroring rule with port representors (with "transfer" attribute), the matched
+ingress packets are sent to port id 2, and also mirrored the packets with
+NVGRE encapsulation header and sent to port id 0.
+
+::
+
+ testpmd> set nvgre ip-version ipv4 tni 4 ip-src 127.0.0.1 ip-dst 128.0.0.1
+ eth-src 11:11:11:11:11:11 eth-dst 22:22:22:22:22:22
+ testpmd> set sample_actions 0 nvgre_encap / port_id id 0 / end
+ testpmd> flow create 0 ingress transfer pattern eth / end actions
+ sample ratio 1 index 0 / port_id id 2 / end
+
+Sample integrity rules
+~~~~~~~~~~~~~~~~~~~~~~
+
+Integrity rules can be created by the following commands:
+
+Integrity rule that forwards valid TCP packets to group 1.
+TCP packet integrity is matched with the ``l4_ok`` bit 3.
+
+::
+
+ testpmd> flow create 0 ingress
+ pattern eth / ipv4 / tcp / integrity value mask 8 value spec 8 / end
+ actions jump group 1 / end
+
+Integrity rule that forwards invalid packets to application.
+General packet integrity is matched with the ``packet_ok`` bit 0.
+
+::
+
+ testpmd> flow create 0 ingress pattern integrity value mask 1 value spec 0 / end actions queue index 0 / end
+
+Sample conntrack rules
+~~~~~~~~~~~~~~~~~~~~~~
+
+Conntrack rules can be set by the following commands
+
+Need to construct the connection context with provided information.
+In the first table, create a flow rule by using conntrack action and jump to
+the next table. In the next table, create a rule to check the state.
+
+::
+
+ testpmd> set conntrack com peer 1 is_orig 1 enable 1 live 1 sack 1 cack 0
+ last_dir 0 liberal 0 state 1 max_ack_win 7 r_lim 5 last_win 510
+ last_seq 2632987379 last_ack 2532480967 last_end 2632987379
+ last_index 0x8
+ testpmd> set conntrack orig scale 7 fin 0 acked 1 unack_data 0
+ sent_end 2632987379 reply_end 2633016339 max_win 28960
+ max_ack 2632987379
+ testpmd> set conntrack rply scale 7 fin 0 acked 1 unack_data 0
+ sent_end 2532480967 reply_end 2532546247 max_win 65280
+ max_ack 2532480967
+ testpmd> flow indirect_action 0 create ingress action conntrack / end
+ testpmd> flow create 0 group 3 ingress pattern eth / ipv4 / tcp / end actions indirect 0 / jump group 5 / end
+ testpmd> flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 1 / end actions queue index 5 / end
+
+Construct the conntrack again with only "is_orig" set to 0 (other fields are
+ignored), then use "update" interface to update the direction. Create flow
+rules like above for the peer port.
+
+::
+
+ testpmd> flow indirect_action 0 update 0 action conntrack_update dir / end
+
+Sample meter with policy rules
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Meter with policy rules can be created by the following commands:
+
+Need to create policy first and actions are set for green/yellow/red colors.
+Create meter with policy id. Create flow with meter id.
+
+Example for policy with meter color action. The purpose is to color the packet
+to reflect the meter color result.
+The meter policy action list: ``green -> green, yellow -> yellow, red -> red``.
+
+::
+
+ testpmd> add port meter profile srtcm_rfc2697 0 13 21504 2688 0 0
+ testpmd> add port meter policy 0 1 g_actions color type green / end y_actions color type yellow / end
+ r_actions color type red / end
+ testpmd> create port meter 0 1 13 1 yes 0xffff 0 0
+ testpmd> flow create 0 priority 0 ingress group 1 pattern eth / end actions meter mtr_id 1 / end
+
+BPF Functions
+--------------
+
+The following sections show functions to load/unload eBPF based filters.
+
+bpf-load
+~~~~~~~~
+
+Load an eBPF program as a callback for particular RX/TX queue::
+
+ testpmd> bpf-load rx|tx (portid) (queueid) (load-flags) (bpf-prog-filename)
+
+The available load-flags are:
+
+* ``J``: use JIT generated native code, otherwise BPF interpreter will be used.
+
+* ``M``: assume input parameter is a pointer to rte_mbuf, otherwise assume it is a pointer to first segment's data.
+
+* ``-``: none.
+
+.. note::
+
+ You'll need clang v3.7 or above to build bpf program you'd like to load
+
+For example:
+
+.. code-block:: console
+
+ cd examples/bpf
+ clang -O2 -target bpf -c t1.c
+
+Then to load (and JIT compile) t1.o at RX queue 0, port 1:
+
+.. code-block:: console
+
+ testpmd> bpf-load rx 1 0 J ./dpdk.org/examples/bpf/t1.o
+
+To load (not JITed) t1.o at TX queue 0, port 0:
+
+.. code-block:: console
+
+ testpmd> bpf-load tx 0 0 - ./dpdk.org/examples/bpf/t1.o
+
+bpf-unload
+~~~~~~~~~~
+
+Unload previously loaded eBPF program for particular RX/TX queue::
+
+ testpmd> bpf-unload rx|tx (portid) (queueid)
+
+For example to unload BPF filter from TX queue 0, port 0:
+
+.. code-block:: console
+
+ testpmd> bpf-unload tx 0 0