3Com 4007, Руководство по внедрению, Страница: 337 / 684

Using Port Groups in Custom Packet Filters 337
Using Port Groups
in Custom Packet
Filters
You can use a port group (a list of module ports) as filtering criteria in a
packet filter.
A packet filter uses the group to make filtering decisions by accessing the
group’s source port group mask and destination port group mask. In the
mask, 32 bits indicate to which of 32 possible groups a port belongs. For
example, setting mask bit number 7 assigns the port to group number 7.
You reference these group masks using the opcodes SPGM (source port
group mask), and DPGM (destination port group mask). What follows is
an example of using port groups in packet filters.
Port Group Packet
Filter Example
In this example, packets are not forwarded to ports in groups 3 and 8.
Port Group Filter
Operation
When an address is learned on a port, the address and the port number
the packet was received on are inserted into the bridge address table and
a bit mask that is associated with the address that denotes the group
membership is inserted into the port group mask table.
The bridge address table stores each SA/DA MAC address with the port
number. The port group masks are stored in a smaller table associating
port numbers to port group masks.
For example, assume you defined port group 1 with port 3 being a
member and port group 2 with port 5 being a member.
Name “Discard Groups 3 and 8”
pushSPGM # Get source port group mask.
pushLiteral.l 0x0084 # Select bits 3 and 8.
and # If port group bits 3 & 8 are common
# with SPGM, then non-zero value is
# pushed onto stack.
pushLiteral.l 0 # Push zero.
eq # Only if SPGM is not in port groups
# corresponding to bits 3 & 8, then
# packet is forwarded.