# BIG-IP packet-filter explainer > Paste net packet-filter rules for the ordered first-match walk with the man page's own semantics, shadow detection, and the platform context every filter decision sits inside. Add a sim: line and an honest three-state simulator answers which rule matches your packet. - Tool: https://ronutz.com/en/tools/f5-packet-filter-explainer - Family: Networking --- # BIG-IP packet-filter explainer Packet filters are the BIG-IP's earliest checkpoint, a BPF-based access policy on incoming traffic that runs before nearly everything you usually think about, and the chapter is explicit that they are unrelated to iRules. This tool walks yours the way the man page would. Paste `net packet-filter` stanzas and the rules render in evaluation order: a single global list, lowest order first, the man page's own worked sequence (500, 100, 300, 200, 201 evaluates as 100, 200, 201, 300, 500) sitting in the golden vectors. Orders must be unique, and duplicates are flagged as the hard error the reference makes them. Evaluation stops on the first match whose action is accept, discard, or reject; continue is the only non-terminal action, acknowledging the packet for logging or statistics and moving to the next rule. The rule expression is mandatory but may be empty, and empty matches ALL packets, so the tool runs deterministic shadow detection: an earlier terminal matches-all rule marks every later rule its VLAN scope covers as unreachable. Add a `sim:` line describing a packet and the simulator answers which rule matches, honestly. The evaluator implements a BPF subset: src and dst host, net with CIDR, port, the protocol keywords in both pcap form and the (proto TCP) form F5's own examples use, with and, or, not, and parentheses. An expression outside that subset stops the walk at that rule rather than guessing, because an unknown primitive cannot even be segmented safely, and every verdict past it would be fiction. The context panel carries what the chapter says always applies: the master switch is disabled by default, and off means no rules operate and all traffic is allowed; trusted exemptions process before rule evaluation and cannot be overridden by any rule; ARP and the important IPv4 ICMP types are exempt by default; established connections are not filtered by default; unmatched packets take the Unhandled Packet Action, default Accept; and the management interface is not affected by any of it. Configuration is parsed, never executed. Everything runs locally; nothing you paste leaves the page. ## Standards and references - [F5 TMSH Reference v17: net packet-filter (four mandatory attributes; order semantics with the worked 500/100/300/200/201 sequence; uniqueness; terminal vs continue; empty rule matches ALL; the three official examples; management interface unaffected)](https://clouddocs.f5.com/cli/tmsh-reference/latest/modules/net/net_packet-filter.html) - the parser's field set, every walk semantic, the example payload - [BIG-IP TMOS Routing Administration 11.6, chapter 6: Packet Filters (global Properties and Exemptions; master switch disabled by default and off-allows-all; Unhandled Packet Action; Filter Established Connections default off; ICMP reject shape; ARP and important-ICMP exemptions; incoming-only; unrelated to iRules)](https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-routing-administration-11-6-0/6.html) - every context note the walk carries - [F5 TMSH Reference v16: net packet-filter-trusted (trusted traffic processes before rule list evaluation, impossible to override with a packet filter rule)](https://clouddocs.f5.com/cli/tmsh-reference/v16/modules/net/net_packet-filter-trusted.html) - the trusted-precedence context note - [pcap-filter(7), the tcpdump project (the BPF expression grammar the rule attribute is written in)](https://www.tcpdump.org/manpages/pcap-filter.7.html) - the simulator's evaluated subset and its honesty boundary ## Related reading - [Packet Filters: The Checkpoint Before Everything, and the Switch That Ships Off](https://ronutz.com/en/learn/bigip-packet-filters.md): BIG-IP packet filters are a BPF-based access policy on incoming traffic, evaluated as one global list in ascending order, first terminal match wins. The master switch ships disabled, trusted exemptions outrank every rule you write, ARP and the important ICMPs walk past by default, established connections are invisible to it, and the management port never meets it at all. Also: as of v16 there is a second, unrelated object wearing the same name.