Filter
Top Products
Creating Packet Filters 12-9
The following example shows the use of both accept and reject in a packet
filter. This packet filter was created for a network running both Phase I and
Phase II AppleTalk.
TM
The goal of the filter is to eliminate the AppleTalk traffic.
Name “Filter AppleTalk datagrams”
pushField.w 12 # Get the type field.
pushTop # Make a copy.
pushLiteral 0x809b # EtherTalk Phase I type
eq # Test if the packet type is
# equal to the AppleTalk type.
reject # Reject the packet and end.
# Otherwise
pushLiteral.w 0x5dc # Largest 802.3 packet size
lt # If this value is less than the
# value in the packet’s
# type/length field, then this
# is an Ethernet frame, so
accept # accept the packet if it is not
# 802.3, otherwise…
pushField.a 16 # get the SNAP OUI and Ethertype
pushLiteral.a 0x03080007809b # value to compare.
ne # If not equal then forward the
# packet, otherwise drop it
Preprocessed and Run-time Storage
A packet filter program is stored in a preprocessed format to minimize the
space required by the packet filter definition. When assigned to a port, the
packet filter is converted from the stored format to a run-time format to
optimize the performance of the filter. Each SuperStack™ II Switch 2200
system is limited to a maximum of 16 packet filter programs.
Preprocessed
packet filters
Each system provides a maximum of 2048 bytes of nonvolatile storage for
preprocessed packet filter programs. In the preprocessed stored format:
■ A single packet filter program is limited to 254 bytes.
■ Each instruction in the packet filter program requires 1 byte for the opcode
and size, plus additional bytes for any explicit operands.
■ System overhead is 22 bytes, plus a per-packet-filter overhead of
13 bytes. For example, assume a packet filter program requires 200 bytes
for storing the instructions in the program. If this packet filter is the only
one loaded, the nonvolatile memory required is 22 bytes (for system
overhead) plus 13 bytes (for packet filter overhead) plus 200 bytes (for the
program itself) — a total of 235 bytes.