Please try with a hexstring, i.e., "test": "substring(hwaddr,0,3) == 0x0a030e" Regards Francis Dupont <fdupont at isc.org> PS: of course hwaddr should be pkt4.chaddr but it is not the point which blocked you.