The Packet Filtering Language; Principles For Writing A Custom Filter; How The Packet Filter Language Works - 3Com 4007 Implementation Manual

The Packet Filtering
Language
Principles for Writing
a Custom Filter
How the Packet Filter
Language Works
You define packet filters using a stack-oriented language, which uses a
LIFO (last in, first out) queue when the packet filter is running. The
program places values (called operands) on the stack and tests them with
various logical expressions (called operators), such as and, or, equal, and
not equal. These expressions typically test the values of various fields in
the received packet, which include MAC addresses, type fields, IP
addresses, or any field within the first 64 bytes of any frame.
Before you write a packet filter, understand these basic principles:

How the Packet Filter Language Works

What Can You Filter?
Implementing Sequential Tests in a Packet Filter
A packet filter program is stored in a preprocessed format to minimize the
space that is required by the packet filter definition. Comments are
stripped. When assigned to a port, the packet filter is converted from the
stored format to a run-time format to optimize the performance of the
filter. Each module is limited to a maximum of 16 packet filter programs.
A program in the packet filter language typically consists of a series of
one or more instructions that results in the top of the stack containing a
byte value after execution of the last instruction in the program. This
top-of-stack byte value determines whether to forward or discard the
packet.
In this stack-oriented language, instructions:
Push operands onto the stack
Pop the operands from the stack for comparison purposes
Push the results back onto the stack
Therefore, with the exception of the push instructions, instructions (such
as logical operators) locate their operands implicitly and do not require
additional operand specifiers in the instruction stream.
Opcodes are the variables that are used to identify the type of operands
and operators you are specifying in the packet filter instructions.

The Packet Filtering Language

319