Hello, Please help me to print firewall connection “dst-address=172.0.0.0/24 protocol=tcp dst-port=110”. How to do that using command CLI or Winbox?
/ip firewall connection
print where protocol="tcp" dst-address~"172.0.0.[0-9]+:110"
Hi blake
Thank you for reply. Please explain me what means [0-9]? Is it possible to print (see) it using WinBox?
First off, the tilde (~) signifies that you want to match the value dst-address against a regular expression. http://wiki.mikrotik.com/wiki/Manual:Scripting#Other_Operators
The [0-9] says that you want the regex to match any single digit between 0 and 9 (ie 0,1,2,3…8,9). The plus sign + means to match the preceding value one or more times. So, it could match 172.0.0.2, 172.0.0.10, or 172.0.0.254.
Being that IPs octets only go from 0-255 a more proper regexp may be ~“172.0.0.[0-2]?[0-5]+”.
Refer to the following link for more info. I’ll leave you to figure out exactly how that last regexp works. 
Hi blake
Thank you again. It is very helpful.