Arris NVG595, Administrator'S Handbook

Page: 130 / 226

Administrator’s Handbook
130
set gfs name filterset_name rule number order number
Determines order of execution of filterset rules (1 before 2, etc). If
order
is unspecified, the value of
order
is
set to 1 more than the last order in the filterset. If order is set to an already existing order value, order values
of other rules are incremented automatically.
set gfs name
filterset_name
rule
number
match
number
category [ src-ip-addr | dst-ip-addr
| ip-proto | src-port | dst-port | tcp-flags | src-host-mac | dst-host-mac | in-link-oid
| out-link-oid | icmp-type ]
Matches on the following categories:
set gfs name filterset_name rule number match number value [ value (category-specific) ]
Queue commands
Queue configuration typically requires a classification component to set a QoS marker to a packet and a queue-
ing component to schedule the marked packets to the link. This is accomplished using filtersets (
“Filterset com-
mands” on page 126 ).
The
basic queue
's
size
and “
length
” are controls for how many packets and total bytes can be enqueued
before it is considered to be full. Once it is full, any attempts to enqueue another packet will result in a “tail-
drop.”
Both constraints are simultaneously used, such that it is full when either packet count OR byte count exceeds
the limit. This allows flexibility in obtaining a balance, where a large number of small packets, but only a small
number of large packets can be enqueued.
If there are no tail-drops – that is, the queue is not blocked from sending and doesn't over-fill and dump pack-
ets – then these queue size/bytes parameters do not affect anything. Their only function is to adjust the
threshold at which the queue is considered full, which dictates when tail drops will occur. So if there are no
src-ip-addr (ip[4|6] address or subnet spec (type ip4 or ip6 only))
dst-ip-addr (ip[4|6] address or subnet spec (type ip4 or ip6 only))
ip-proto (0-255 or iana-defined string equivalents)
src-port
(1-65535[:1-65535], only if
ip-proto
== TCP or UDP)
dst-port
(1-65535[:1-65535], only if
ip-proto
== TCP or UDP)
tcp-flags (only if ip-proto == TCP)
icmp-type (only if ip-proto == ICMP or IPv6 ICMP)
src-host-mac (MAC address of src)
dst-host-mac (MAC address of dest)
in-link-oid
(oid of ingress link oid)
out-link-oid
(oid of egress link oid)
NOTE:
A rule cannot contain data that specifies both IPv6 and IPv4 at the same time, and thus be applicable to nei-
ther iptables nor ip6tables; however, a rule can be IP-version-agnostic, in which case it will be applied to both
iptables and ip6tables, given the proper conditions. For instance, if a LAN-side device has both an IPv4
address and a routable IPv6 address, then one can specify a rule for this device by referring to its MAC
address, and if no other match attributes of the rule preclude its use in both tables, the rule will be applied to
both iptables and ip6tables (given the assumption that the LAN Host Discovery database contains both
addresses).