So, a couple of extra anecdotes from after I published that post. I linked that post to our internal chat, and our support manager was all "Oh wow, that VLAN s

So, a couple of extra anecdotes from after I published that post. I linked that post to our internal chat, and our support manager was all "Oh wow, that VLAN section totally explains why those filters at customer X two weeks ago didn't work". This is 4 years into trying to make sure that everyone using the filters to configure our system knows about this pitfall. They knew about a couple of failure modes in the list, but not all of them :-( An hour after that I had a discussion with someone who knows the language very well, and we were puzzled about why the silly "look for a specific TCP option" filter was compiling to something that looked like it wouldn't work with ipv6. Turns out that while "tcp" works with IPv4 and IPv6, "tcp[]" works only on IPv4. He knew it but had forgotten, while I'd never parsed the documentation correctly to know about it. (There's a comment in the code generator suggesting that this is maybe not how things should work).