When Is A Filter Applied? - Paths - 3Com corebuilder 3500 Implementation Manual

Packet Filtering Overview 211
You must filter on the input packet type. For example, if you write a filter
that you intend to assign to the transmit path of an Ethernet port, it will
not be sufficient to compose a filter that only filters Ethernet traffic. This
is because the filtering function is applied before the conversion to
Ethernet format. Consider all possible sources of the packets. Might the
packet originate as an FDDI packet? If so, then filter on the FDDI format
as well as any Ethernet source formats.
When Is a Filter Packets travel on many different paths through the switch. You can
Applied? — Paths control to which path a filter is applied.
Input Packet Filtering: Receive Path
Input packet filtering applies to packets immediately upon reaching the
switch port, before they reach the switch's internal forwarding processing
(receive path). Because the packets never enter the switch, the switch
itself is protected against an external attack.
Output Packet Filtering: Transmit Path
Output packet filtering applies to packets after they have been through
the switch's internal forward processing (transmit path).
Internal Packet Filtering: Receive Internal Path
Internal packet filtering applies to packets intended for the switch itself
(such as pings, Telnet packets, and so forth) on the receive internal path.