Filter
Top Products
8-88 User’s Reference Guide
Note the Offset is set to look at a value six bytes into the packet, the Value is 0000C8E395000000 and
the Mask is set to match only the hexidecimal digits we're interested in -- the ones that represent the MAC
address.
■ The next item that's commonly evaluated in a Generic filter is the frame type. The frame type is located at
an offset of twelve bytes. For IP packets it has a value of 0800 (hex) and for ARP the value is 0806 (hex).
So a filter set summary to block all incoming IP and ARP packets looks like this:
A filter set blocking all incoming IPX requires two filter rules. One to verify the byte with offset of 12 bytes is
less than 600 (hex) ANDed (chained with) a filter that verifies the byte offset by 14 is not equal to FFFF.
■ The filter set should look like this (with the first filter rule's chain field set to “Yes” because the packet has
to match both rules to be qualified as an IPX packet.)
Add Input Filter
Enabled: Yes
Forward: No
Type... Generic
Value: 0000C8E395000000
Mask: FFFFFFFFFF000000
Offset: 6
Compare: Equal
Chain to Next Filter: No
ADD THIS FILTER NOW CANCEL
Enter the packet specific information for this filter.
+-#----Value-------------Mask--------------Offst-Compare--Chain---On?-Fwd-+
+-------------------------------------------------------------------------+
| 1 0800000000000000 FFFF000000000000 12 = No Yes No |
| 2 0806000000000000 FFFF000000000000 12 = No Yes No |
| |
| |
+-#----Value-------------Mask--------------Offst-Compare--Chain---On?-Fwd-+
+-------------------------------------------------------------------------+
| 1 0600000000000000 FFFF000000000000 12 < Yes Yes |
| 2 FFFF000000000000 FFFF000000000000 14 = No Yes No |
| |