Example 2: Filtering Appletalk Phase Ii Packets - 3Com LANPLEX 2500 Operation Manual

7-6 C 7: U
HAPTER SER
Destination
address
0 6
- P F
DEFINED ACKET ILTERING

Example 2: Filtering AppleTalk Phase II Packets

If your Macintosh computers use the AppleTalk Phase II protocol instead of
the AppleTalk Phase I protocol (as shown in Example 1), then you must use
a filter slightly more complicated.
AppleTalk Phase II uses 802.3 protocol instead of Ethernet as the physical
layer protocol. Ethernet and 802.3 packets are distinguished using the
2-byte field at offset 12 in the packet. The filter must first ensure that the
packet is an 802.3 packet. If that field is:
Greater than 1500, then the packet is an Ethernet packet and the value is
interpreted as the type field.
Less than or equal to 1500, then the packet is an 802.3 packet and the value
is interpreted as the data length.
In an AppleTalk Phase II packet, a Subnetwork Access Protocol (SNAP)
"header" follows the 802.3 header. See Figure 7-4. The filter must verify that
the contents of this SNAP field match the AppleTalk packet's
SNAP field.
SNAP header = AAAA03080007809b
Length
Source
address
12 14 16
Figure 7-4 AppleTalk Phase II Packet Fields
The filter definition for filtering AppleTalk Phase II packets is:
if (type field <= 1500) AND (SNAP = 0x03080007809b) then discard
packet
LLC
data
22 25
AppleTalk Phase II Packet
®