Using Groups In Packet Filters - 3Com LANPLEX 6000 User Manual

15
Using Groups in
Packet Filters
Address group packet
filter example
C
ONFIGURING
P G
ORT ROUPS TO
P F
ACKET
This chapter describes how to use address and port groups as filtering
criteria in a packet filter, and how to administer address and port groups.
You can use address groups (a list of MAC addresses) and port groups (a list
of LANplex Ethernet and FDDI ports) as filtering criteria in a packet filter.
For more information about address and port group concepts, see Chapter 7:
User-defined Packet Filtering in the LANplex 6000 Operation Guide.
A packet filter uses groups to make filtering decisions by accessing the
source group mask and the destination group mask of a group. You
reference these group masks using the opcodes: SAGM (source address
group mask), DAGM (destination address group mask), SPGM (source port
group mask), and DPGM (destination port group mask). Below are examples
of using address and port groups in packet filters.
In this example, the filter only forwards packets among stations that are
within the same address group.
Name "Accept Same Source and Destination"
pushSAGM
pushDAGM
and
pushLiteral.l 0
ne
A
DDRESS AND
U
ILTERS
# Get source address group mask
# Get destination address
# group mask
# Compare if source address and
# destination address are common
# members of an address group (result
# is either zero or non-zero)
# Put a zero on the stack
# If not equal, returns a "one" to
# stack, resulting in packet
# forwarded
SE IN