3Com 4007, Implementation Manual, Page: 319 / 684

The Packet Filtering Language 319
The Packet Filtering
Language
You define packet filters using a stack-oriented language, which uses a
LIFO (last in, first out) queue when the packet filter is running. The
program places values (called
operands ) on the stack and tests them with
various logical expressions (called operators ), such as and , or , equal , and
not equal.
These expressions typically test the values of various fields in
the received packet, which include MAC addresses, type fields, IP
addresses, or any field within the first 64 bytes of any frame.
Principles for Writing
a Custom Filter
Before you write a packet filter, understand these basic principles:
■
How the Packet Filter Language Works
■
What Can You Filter?
■
Implementing Sequential Tests in a Packet Filter
A packet filter program is stored in a preprocessed format to minimize the
space that is required by the packet filter definition. Comments are
stripped. When assigned to a port, the packet filter is converted from the
stored format to a run-time format to optimize the performance of the
filter. Each module is limited to a maximum of 16 packet filter programs.
How the Packet Filter
Language Works
A program in the packet filter language typically consists of a series of
one or more instructions that results in the top of the stack containing a
byte value after execution of the last instruction in the program. This
top-of-stack byte value determines whether to forward or discard the
packet.
In this stack-oriented language, instructions:
■
Push operands onto the stack
■
Pop
the operands from the stack for comparison purposes
■
Push the results back onto the stack
Therefore, with the exception of the push instructions, instructions (such
as logical operators) locate their operands implicitly and do not require
additional operand specifiers in the instruction stream.
Opcodes are the variables that are used to identify the type of operands
and operators you are specifying in the packet filter instructions.