Implementing Sequential Tests In A Packet Filter - 3Com SUPERSTACK 2200 User Manual

12-8 C 12: C
HAPTER REATING AND
U P F
SING ACKET ILTERS

Implementing Sequential Tests in a Packet Filter

Filter language expressions are normally evaluated to completion —
a packet is accepted if the value remaining on the top of the stack is
non-zero. Frequently, however, a single test is insufficient to filter packets
effectively. When more tests are warranted, you want to accept a packet
that either:
Satisfies at least one criterion specified in two or more tests (that is, ORs the
results of the tests), or
Satisfies all criteria specified in two or more tests (ANDs the results of the
tests)
The accept and reject instructions are used to implement sequential tests,
as shown in Figure 12-2. When using accept or reject, construct the packet
filter so that the tests more likely to be satisfied are performed before tests
that are less likely to be satisfied.
Accept
(Use for OR-ing tests)
First test
Non-zero
result? Yes
No
Next test
Figure 12-2 Accept and Reject Instructions
First test
Non-zero
Accept packet
result?
and terminate
test sequence
Next test
Reject
(Use for AND-ing tests)
Reject packet
Yes
and terminate
test sequence
No