Filter
Top Products
8-72 User’s Reference Guide
This header information is what the packet filter uses to make filtering decisions. It is important to note that an
IP packet filter does not look into the IP data stream (the User Data from above) to make filtering decisions.
Generic filters can look into the data.
BB
BB
aa
aa
ss
ss
ii
ii
cc
cc
pp
pp
rr
rr
oo
oo
tt
tt
oo
oo
cc
cc
oo
oo
ll
ll
tt
tt
yy
yy
pp
pp
ee
ee
ss
ss
TCP: Transmission Control Protocol. TCP provides reliable packet delivery and has a retransmission
mechanism (so packets are not lost). RFC 793 is the specification for TCP.
UDP: User Datagram Protocol. Unlike TCP, UDP does not guarantee reliable, sequenced packet delivery. If data
does not reach its destination, UDP does not retransmit the data. RFC 768 is the specification for UDP.
There are many more ports defined in the Assigned Addresses RFC. The tables on page 8-66 show some of
these port assignments.
FF
FF
ii
ii
ll
ll
tt
tt
ee
ee
rr
rr
LL
LL
oo
oo
gg
gg
ii
ii
cc
cc
Filter design is a test of logic, and filter rule ordering is critical. If a packet is passed through a series of filter
rules and then the packet matches a rule, the appropriate action is taken. The packet will not pass through the
remainder of the filter rules.
For example, if you had the following filter set...
Allow WWW access;
Allow FTP access;
Allow SMTP access;
Deny all other packets.
and a packet goes through these rules destined for FTP, the packet would pass through the first rule (WWW), go
through the second rule (FTP), and match this rule; the packet is allowed through.
If you had this filter set for example....
Allow WWW access;
Allow FTP access;
Deny FTP access;
Deny all other packets.
and a packet goes through these rules destined for FTP, the packet would pass through the first filter rule
(WWW), match the second rule (FTP), and the packet is allowed through. Even though the next rule is to deny all
FTP traffic, the FTP packet will never make it to this rule.
BB
BB
ii
ii
nn
nn
aa
aa
rr
rr
yy
yy
rr
rr
ee
ee
pp
pp
rr
rr
ee
ee
ss
ss
ee
ee
nn
nn
tt
tt
aa
aa
tt
tt
ii
ii
oo
oo
nn
nn
It is easiest when doing filtering to convert the IP address and mask in question to binary. This will allow you to
perform the logical AND to determine whether a packet matches a filter rule.
LL
LL
oo
oo
gg
gg
ii
ii
cc
cc
aa
aa
ll
ll
AA
AA
NN
NN
DD
DD
ff
ff
uu
uu
nn
nn
cc
cc
tt
tt
ii
ii
oo
oo
nn
nn
When a packet is compared (in most cases) a logical AND function is performed. First the IP addresses and
subnet masks are converted to binary and then combined with AND. The rules for the logical use of AND are as
follows: