The "ipv4options" module allows one to match against a set of IPv4 header options.

--flags [!]symbol[,[!]symbol...]
    Specify the options that shall appear or not appear in the header. Each symbol specification is delimited by a comma, and a '!' can be prefixed to a symbol to negate its presence. Symbols are either the name of an IPv4 option or its number. See examples below.

--any
    By default, all of the flags specified must be present/absent, that is, they form an AND condition. Use the --any flag instead to use an OR condition where only at least one symbol spec must be true.

Known symbol names (and their number):

1 — nop

2 — security — RFC 1108

3 — lsrr — Loose Source Routing, RFC 791

4 — timestamp — RFC 781, 791

7 — record-route — RFC 791

9 — ssrr — Strict Source Routing, RFC 791

11 — mtu-probe — RFC 1063

12 — mtu-reply — RFC 1063

18 — traceroute — RFC 1393

20 — router-alert — RFC 2113

Examples:

Match packets that have both Timestamp and NOP: -m ipv4options --flags nop,timestamp

~ that have either of Timestamp or NOP, or both: --flags nop,timestamp --any

~ that have Timestamp and no NOP: --flags '!nop,timestamp'

~ that have either no NOP or a timestamp (or both conditions): --flags '!nop,timestamp' --any