Remove the '' in: "test": "/substring(pkt4.mac, 0, 6) = '0x00d0550b6076'", so you should use: "test": "/substring(pkt4.mac, 0, 6) = 0x00d0550b6076", Regards Francis Dupont <fdupont at isc.org>