Filter
Top Products
12-4 CHAPTER 12: CREATING AND USING PACKET FILTERS
Concepts for Writing
a Filter
Before writing a packet filter, you should understand thsee basic concepts:
■ How the packet filter language works
■ The basic elements of a packet filter
■ How to implement sequential tests in a packet filter
■ The pre-processed and run-time storage requirements
How the Packet Filter Language Works
You define packet filters using a simple, stack-oriented language. Stack-
oriented means that the language uses a LIFO (last in, first out) queue when
the packet filter is running. The program places values (called operands) on
the stack and tests them with various logical expressions (called operators),
such as and, or, equal, and not equal (see Table 12-3 and Table 12-4). These
expressions typically test the values of various fields in the received packet,
which include MAC addresses, type fields, IP addresses, and Service Access
Points (SAPs).
A program in the packet filter language consists of a series of one or more
instructions that results in the top of the stack containing a byte value after
execution of the last instruction in the program. This byte value determines
whether to forward or discard the packet.
In this stack-oriented language, instructions:
■ push operands onto the stack
■ pop the operands from the stack for comparison purposes
■ push the results back onto the stack
Therefore, with the exception of the push instructions, instructions (such as
logical operators) locate their operands implicitly and do not require
additional operand specifiers in the instruction stream.
Opcodes are the variables used to identify the type of operands and
operators you are specifying in the packet filter instructions.