---
title: Create a filter for Advanced TCP Protection · Cloudflare DDoS Protection docs
description: A filter modifies Advanced TCP Protection's execution mode — monitoring, mitigation (enabled), or disabled — for all incoming packets matching an expression.
lastUpdated: 2024-11-04T15:20:19.000Z
source_url:
  html: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/ddos-protection/advanced-ddos-systems/how-to/create-filter/index.md
  md: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/ddos-protection/advanced-ddos-systems/how-to/create-filter/
---

A filter modifies Advanced TCP Protection's [execution mode](https://developers.cloudflare.com/ddos-protection/advanced-ddos-systems/concepts/#mode) — monitoring, mitigation (enabled), or disabled — for all incoming packets matching an expression.

Each protection system component (SYN flood protection or out-of-state TCP protection) should have at least one [rule](https://developers.cloudflare.com/ddos-protection/advanced-ddos-systems/concepts/#rule), but filters are optional.

Note

Filters only apply to Advanced TCP Protection.

## Procedure

To create a [filter](https://developers.cloudflare.com/ddos-protection/advanced-ddos-systems/concepts/#filter) for one of the system components:

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account.
2. Go to **L3/4 DDoS** > **Advanced Protection** > **Advanced TCP Protection**.
3. Under the system component for which you are creating the filter (**SYN Flood Protection** or **Out-of-state TCP Protection**), select **Create** next to the type of filter you want to create:

* **Mitigation Filter**: The protection system will drop packets matching the filter expression.
* **Monitoring Filter**: The protection system will log packets matching the filter expression.
* **Off Filter**: The protection system will ignore packets matching the filter expression.

1. Under **When incoming packets match**, define a filter expression using the Expression Builder (specifying one or more values for **Field**, **Operator**, and **Value**), or manually enter an expression using the Expression Editor. For more information, refer to [Edit rule expressions](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/edit-expressions/).
2. Select **Save**.

Note

Filters take precedence over rules. For details on how the execution mode is determined, refer to [Determining the execution mode](https://developers.cloudflare.com/ddos-protection/advanced-ddos-systems/concepts/#determining-the-execution-mode).
