Introduction to Filtering
3.2
— Orbitor 6000 Installation & Applications Guide
Pattern Filtering
Pattern filtering is provided in three separate sections: Bridge Pattern Filters, IP Router
Pattern Filters, and IPX Router Pattern Filters. When the Orbitor is operating as an
IP/IPX Bridge/Router, each of the frames received from the local LAN is passed on to the
appropriate internal section of the Orbitor. The IPX frames are passed on to the IPX
router, the IP frames are passed on to the IP router, and all other frames are passed on to
the bridge. Different pattern filters may be defined in each of these sections to provide
very extensive pattern filtering on LAN traffic being sent to remote LANs.
Pattern filters are created by defining an offset value and a pattern match value. The offset
value determines the starting position for the pattern checking. An offset of 0 indicates
that the pattern checking starts at the beginning of the data frame. An offset of 12
indicates that the pattern checking starts at the 12
th
octet of the data frame. When a data
frame is examined in its HEX format, an octet is a pair of HEX values with offset location
0 starting at the beginning of the frame. Please refer to
Appendix C - Octet Locations on
Ethernet Frames
for more information on octet locations in data frames.
The pattern match value is defined as a HEX string that is used to match against the data
frame. If the HEX data at the appropriate offset location in the data frame matches the
HEX string of the filter pattern, there is a positive filter match. The data frame will be
filtered according to the filter operators being used in the filter pattern.
The following operators are used in creating Pattern filters.
-
offset
Used in pattern filters to determine the starting position to start the pattern
checking.
Example:
12-80
This filter pattern will match if the packet
information starting at the 12
th
octet equals the
80 of the filter pattern.
|
OR
Used in combination filters when one
or
the other conditions must be met.
Example:
10-20|12-80
This filter pattern will match if the packet
information starting at the 10
th
octet equals the
20 of the filter pattern or if the packet
information starting at the 12
th
octet equals the
80 of the filter pattern.
&
AND
Used in combination filters when one
and
the other conditions must be
met.
Example:
10-20&12-80
This filter pattern will match if the packet
information starting at the 10
th
octet equals the
20 of the filter pattern and the packet information
starting at the 12
th
octet equals the 80 of the filter
pattern.
~
NOT
Used in pattern filters to indicate that all packets
not
matching the defined
pattern will be filtered.
