Table of Contents
Advertisement
27-4
C
27: P
HAPTER
ACKET
F
ILTERS
Table 27-2
Field
line #
verb
keyword
operator
value
The OR operation can be implemented by successive ACCEPT rules. For example,
to accept a packet if the source address is xxx, or the destination address is yyy,
use the following rules:
IP:
010 ACCEPT src-addr = xxx;
020 ACCEPT dst-addr = yyy;
Generic Filter Rules
Generic filter rules are similar in format to protocol filter rules. The following
shows the rule syntax.
The rule syntax is:
<line #> <verb> <keyword> <operator> origin = <DATA | FRAME>
offset = <value>/length = <value>/mask = <hexadecimal value>/
value = <hexadecimal value>;
The following table describes each field used in the rule syntax:
Description
Each rule must have a unique line number (1-999). You must arrange
rules in increasing order.
This field can be one of the following:
ACCEPT - allow the packet access if the condition is met
REJECT - do not allow the packet access if the condition is met
AND - logically use the AND condition with condition of the next
rule to determine if the packet is accepted or rejected. Both
defined conditions must be met.
For descriptions, see Keyword section at the end of this chapter
Describes the relationship between the keyword and its value. The
operator field must be one of the following symbols that apply to the
specific keyword used:
= Equal
!= Not Equal
> Greater Than
< Less Than
>= Greater Than or Equal To
<= Less Than or Equal To
=> Generic
Contains an entity appropriate for the Keywords as described at the
end of this chapter.
Advertisement
Table of Contents
