Procedure For Writing A Filter - 3Com LANPLEX 6000 User Manual

14-10 C 14: C
HAPTER
Run-time storage of
packet filters
Procedure for
Writing a Filter
U P
REATING AND SING ACKET
For run-time storage of packet filter programs, each switching module
provides a maximum of 8192 bytes. There is no explicit system or per packet
filter overhead; however, performance considerations may result in unused
areas of the run-time storage.
The run-time format is approximately eight times the size of the stored
format. Thus a 200-byte packet filter program in stored format expands to
approximately 1600 bytes in the run-time format. A single packet filter
program cannot exceed 2048 bytes in the run-time format.
The following steps show the process of writing a packet filter. Detailed
examples are provided in the section "Examples of Creating Filters" on
page 14-12.
Write the instructions for the packet filter using the following format:
<opcode>[.<size>]
You can find the opcode descriptions in the section Appendix A: Packet
Filter Opcodes, Examples, and Syntax Errors. The description of the operand
sizes supported can be found in Table 14-2 on "Packet Filter Instructions and
Stacks — Descriptions and Guidelines". The operand value is determined
by what you are testing (for example, an address or a length).
Implicit operands for an instruction must be of the size expected by the
instruction. Any mismatch in implicit operand size results in an error
"operand size mismatch" when the program is loaded into the system.
When writing a packet filter, ensure that you use comments (preceded by #)
to describe each step in the filter. This will help you to revise filters in the
future and enable others to understand and use the filters you create.
To write a packet filter:
1 Assign a unique, descriptive name to the filter using the
2 Specify what to test. For example, use the
field in the packet.
3 Specify what to compare to the value in step 2. For example, use the
opcode to select a constant value.
pushLiteral
F
ILTERS
[<operand>...] [# <comment>]
opcode.
Name
opcode to select a
pushField