Enterasys ATX User Manual page 58

Using ATX Port Filtering
If you want to filter on a single source or destination address, make sure the address is
entered in both the Begin and End text boxes.
TIP
You can use both the source and destination address fields to filter data based on
equipment vendor, since the first three bytes of a MAC address are unique to a specific
vendor. For example, Sun workstations have a MAC address with the first three bytes
08:00:20. By setting a filter range of 08:00:20:00:00:00 to 08:00:20:FF:FF:FF, you could
filter all Sun workstation traffic on a particular segment.
7. You can use a data field value as a filter criteria by using the Field Offset
4-8
parameters. A data field value allows you to examine a packet (at a location
specified by a data Field Offset) for up to 64 bytes of data that will act as the
filtering criteria. To specify the portion of the packet you want examined, you
indicate where you want the data field to be examined (relative to an Origin
point), and enter the data value that you want to filter on (using a mask if
necessary to ignore any "don't care" bytes). To use the Field Offset
parameters:
a. In the Filter Parameters section, click on the Field Offset check box to
activate the Field Offset text fields.
b. Indicate whether you want the specified field offset to be exclusive or
inclusive for filtering purposes.
1.) Click to activate (highlight) the Don't Match check box if you want the
packet to be filtered if it does not match the field offset value.
2.) Click to de-activate (gray-out) the Don't Match check box if you want
to the packet to be filtered if it matches the field offset value. This is
the default.
c. Click in the Offset text field, and type in the offset — in hexadecimal —
that indicates the number of bytes from the origin (discussed in the next
step) at which you want to begin examining the packet's data field. For
example, an Offset of 1A indicates that you want to examine the packet
starting 26 bytes after the specified origin point.
d. Click on the Origin: button to determine where you want the field offset to
begin:
1.) Select MAC if you want the offset to be applied relative to the
beginning of the MAC addresses; an offset of 0 indicates the start of
the destination MAC address.
2.) Select IP if you want the offset to be relative to the end of the IP
header; an offset of 0 indicates the portion immediately following the
end of the IP header.
3.) Select SR if you want the offset to be relative to the end of the MAC
header, including the Source Routing (SR) header, if present.
Editing the Port Filters Table