match


match without changing pass/block state

actions are applied on the fly
set queue, rtable/rdomain, tos
scrub
log
nat-to, rdr-to, binat-to