Pattern filtering – Perle Systems 1700 User Manual

Page 72

Introduction to Filtering

Pattern Filtering

Pattern filtering is provided in three separate sections: Bridge Pattern Filters, IP Router

Pattern Filters, and IPX Router Pattern Filters. When the router is operating as an IP/IPX

Bridge/Router, each of the frames received is passed on to the appropriate internal section

of the router. The IPX frames are passed on to the IPX router, the IP frames are passed

on to the IP router, and all other frames are passed on to the bridge. Different pattern

filters may be defined in each of these sections to provide very extensive pattern filtering on

LAN traffic being sent to remote LANs.

Pattern filters are created by defining an offset value and a pattern match value. The offset

value determines the starting position for the pattern checking. An offset of 0 indicates that

the pattern checking starts at the beginning of the data frame. An offset of 12 indicates that

the pattern checking starts at the 12

octet of the data frame. When a data frame is

examined in its HEX format, an octet is a pair of HEX values with offset location 0 starting

at the beginning of the frame. Please refer to Appendix C - Octet Locations on Ethernet Frames

for more information on octet locations in data frames.

The pattern match value is defined as a HEX string that is used to match against the data

frame. If the HEX data at the appropriate offset location in the data frame matches the

HEX string of the filter pattern, there is a positive filter match. The data frame will be

filtered according to the filter operators being used in the filter pattern.

The following operators are used in creating Pattern filters.

offset

Used in pattern filters to determine the starting position to start the pattern

checking.

Example:

12-80

This filter pattern will match if the packet

information starting at the 12

octet equals the 80

of the filter pattern.

Used in combination filters when one or the other conditions must be met.

Example:

10-20|12-80

This filter pattern will match if the packet

information starting at the 10

octet equals the 20

of the filter pattern or if the packet information

starting at the 12

octet equals the 80 of the filter

pattern.

AND

Used in combination filters when one and the other conditions must be

met.

Example:

10-20&12-80

This filter pattern will match if the packet

information starting at the 10

octet equals the 20

of the filter pattern and the packet information

starting at the 12

octet equals the 80 of the filter

pattern.

NOT

Used in pattern filters to indicate that all packets not matching the defined

pattern will be filtered.