doc: starting list of variables

1 files changed, 24 insertions, 0 deletions

diff --git a/doc/VARIABLES.md b/doc/VARIABLES.md
new file mode 100644
index 0000000..cf7a07c
--- /dev/null
+++ b/doc/VARIABLES.md
@@ -0,0 +1,24 @@
+
+Corset Firewall
+Copyright (C) 2023 David M. Syzdek <david@syzdek.net>.
+All rights reserved.
+
+
+Built-in Variables
+==================
+
+   * %D - dst port (TCP, UDP, etc)
+   * %d - dst address
+   * %E - Ether Type: ipv4, ipv6, etc
+   * %e - Ether Type: 0x0800 (IPv4), 0x86DD (IPv6), etc
+   * %H - dst hardware address (i.e. MAC address)
+   * %h - src hardware address (i.e. MAC address)
+   * %I - icmp/icmpv6 code
+   * %i - icmp/icmpv6 type
+   * %N - NIC ID
+   * %n - NIC name
+   * %P - protocol: tcp, udp, icmp, etc
+   * %p - protocol: 0x06 (tcp), 0x11 (udp), 0x01 (icmp), etc
+   * %S - src port (TCP, UDP, etc)
+   * %s - src address
+