Filter
Top Products
12-16 CHAPTER 12: CREATING AND USING PACKET FILTERS
Combining a Subset of the Filters. The next filter accepts IP packets with
a socket range of 0x76c (1900) and 0x898 (2200). The filter combines packet
filters one and two, modifying them for IP. These steps show how to create
this filter.
1 Name the filter:
“Only IP pkts w/in socket range”
2 Perform steps 2 through 4 as described in “Packet Filter One” on page 12-14,
except give the pushLiteral instruction (in step 3) a value of 0x0800 for IP.
3 Perform steps 2 through 8 as described in “Packet Filter Two” on page 12-15,
except the socket value for IP (in step 3) is located 24 bytes into the packet
(instead of 30 as for XNS).
4 Add an and statement to compare the results of step 2 with the results of
step 3:
and # compare if IP and in range
This combination looks like this:
Name “Only IP pkts w/in socket range”
pushField.w 12 # get the type field of the packet and
# place it on top of the stack
pushLiteral.w 0x0800 # put the type value for IP on top of
# the stack
eq # if the two values on the top of the
# stack are equal, then return a non-zero
# value
pushLiteral.w 0x76c # put the lowest socket value on top of
# the stack (1900)
pushField.w 24 # put the value of the socket from the
# packet on top of the stack
ge # compare if the value of the socket is
# greater than or equal to the lower bound
pushLiteral.w 0x0898 # put the highest socket value on top of
# the stack (2200)
pushField.w 24 # put the value of the socket from the
# packet on top of the stack
lt # compare if the value of the socket is
# less than the upper bound
and # “and” together with “ge” and “lt” test
# to determine if the socket value is
# “within” the range. If it is in range, a
# “one” will be placed on the stack.
and # compare if IP and in range