Packet Matching Criteria - Alcatel-Lucent 7450 ESS OS Configuration Manual

Packet Matching Criteria

Up to 65535 IP and 65535 MAC filter IDs (unique filter policies) can be defined. A maximum of
16384 filter entries can be defined in one filter at the same time. Each filter ID can contain up to
65535 filter entries. A maximum of 16384 filter entries can be defined in 1 filter at the same time.
As few or as many match parameters can be specified as required, but all conditions must be met in
order for the packet to be considered a match and the specified action performed. The process
stops when the first complete match is found and then executes the action defined in the entry,
either to drop or forward packets that match the criteria.
IP filter policies match criteria that associate traffic with an ingress or egress SAP. Matching
criteria to drop or forward IP traffic include:
•
•
•
•
•
•
•
•
•
•
7450 ESS OS Router Configuration Guide
Source IP address and mask
Source IP address and mask values can be entered as search criteria. The IP Version 4
addressing scheme consists of 32 bits expressed in dotted decimal notation (X.X.X.X).
Address ranges are configured by specifying mask values, the 32-bit combination used to
describe the address portion which refers to the subnet and which portion refers to the
host. The mask length is expressed as an integer (range 1 to 32).
Destination IP address and mask — Destination IP address and mask values can be
entered as search criteria.
Protocol — Entering a protocol ID (such as TCP, UDP, etc.) allows the filter to search for
the protocol specified in this field.
Source port/range — Entering the source port number or port range allows the filter to
search for matching TCP or UDP port and range values.
Destination port/range — Entering the destination port number or port range allows the
filter to search for matching TCP or UDP values .
DSCP marking — Entering a DSCP marking enables the filter to search for the DSCP
marking specified in this field. See
page 306.
ICMP code — Entering an ICMP code allows the filter to search for matching ICMP code
in the ICMP header.
ICMP type — Entering an ICMP type allows the filter to search for matching ICMP types
in the ICMP header.
Fragmentation — IPv4 only: Enable fragmentation matching. A match occurs if packets
have either the MF (more fragment) bit set or have the Fragment Offset field of the IP
header set to a non-zero value.
Option value — Entering an option value enables the first filter to search for a specific IP
option.
Table 8, DSCP Name to DSCP Value Table, on
Filter Policies
Page 313