Filter
Top Products
Creating Filters Using Command Line Interface 6-31
following rules are used:
IP:
1 ACCEPT src-addr=xxx;
2 ACCEPT dst-addr=yyy;
999 DENY;
(This will only accept packets from the specified address(es); all other packets will
be rejected.)
The following table describes the keywords for each protocol section and their
legal operators used in the rule syntax. Value ranges are also given where ddd is a
decimal between 1 and 255, mask is a decimal between 1 and 32, and xx is a hex
number:
Generic Filter Rule The syntax for generic filters is slightly different than that for other filters:
<line #> <verb> GENERIC => ORIGIN = <FRAME > DATA>/OFFSET = <# of bytes>/
LENGTH = <# of bytes>/MASK = < 0x Mask>/VALUE = <0x value>
■ ORIGIN - The location in the packet to start the offset count. This location can
be at byte 0 (FRAME) or at the start of the protocol data (DATA).
■ OFFSET - The number of bytes from the origin to skip before comparing the
value to the packet contents.
■ LENGTH - The number of bytes in the packet to compare to the value.
■ MASK - The mask to logically "and" with the packet contents before
comparing with the value (hex).
Table6-4 Protocol Keywords
Protocol
Section
Keyword Operators Description and Value Range
IP src-addr
dst-addr
tcp-src-port
tcp-dst-port
udp-src-port
udp-dst-port
protocol
generic
=, !=
=, !=
all
all
all
all
=, !=
=
Source IP Address (ddd.ddd.ddd.ddd/mask)
Destination IP Address (ddd.ddd.ddd.ddd/mask)
TCP source port (1 - 65535)
TCP destination port (1 - 65535)
UDP source port (1-65535)
UDP destination port (1-65535)
IP protocol (UDP, TCP, ICMP)
Generic filter
IP-RIP network =, != IP network number (ddd.ddd.ddd.ddd/mask)
IPX src-net
dst-net
src-host
dst-host
src-socket
dst-socket
generic
=, !=
=, !=
=, !=
=, !=
all
all
=
Source IPX network (xx-xx-xx-xx)
Destination IPX network (xx-xx-xx-xx)
Source IPX host node address (xx-xx-xx-xx-xx-xx)
Destination IPX host node address (xx-xx-xx-xx-xx-xx)
Source IPX socket (0x1 - 0xFFFF)
Destination IPX socket (0x1 - 0xFFFF)
Generic Filter
IPX-RIP network =, != IPX network (xx-xx-xx-xx)
IPX-SAP network
node
server
service-type
socket
=, !=
=, !=
=, !=
=, !=
all
IPX network (xx-xx-xx-xx)
IPX node (xx-xx-xx-xx-xx-xx)
Server name (character string to 32 characters)
Service type (0x0 - 0xFFFF)
Socket (0x1 - 0xFFFF)
BR-ETH src-addr
dst-addr
generic
=, !=
=, !=
=
Source MAC address (xx-xx-xx-xx-xx-xx)
Destination MAC address (xx-xx-xx-xx-xx-xx)
Generic filter