3Com 4007, Руководство по внедрению, Страница: 344 / 684

344 C
HAPTER
15: P
ACKET
F
ILTERING
The rest of this section concentrates on the parts of the complex filter,
showing you how to translate the pseudocode’s requirements into filter
language. The large filter is broken down into subsets to show how you
can create small filters that perform one or two tasks, and then combine
them for more sophisticated filtering. Table 70 describes how the purpose
of each pseudocode step is accomplished in the small series of packet
filters.
Packet Filter One
This filter is designed to leave a non-zero value on the stack for XNS
broadcast packets. If used alone, this filter accepts the very packets we
are trying to filter. The reason for doing this will become clear when the
filter is combined later in this section.
These steps show how to create this filter.
1 Name the filter:
Name “Forward only XNS packets”
It is important to distinguish the function of each filter when it is loaded
onto a system that has more than one filter stored in memory. Naming is
also useful for archiving filters on a remote system so that the filters can
be saved and loaded on one or more systems.
2 Enter executable instruction #1:
pushField.a 0
# Clear the stack
3 Enter executable instruction #2:
pushField.a 0xffffffffffff
# Put the broadcast address on the top of the stack
Table 70 Pseudocode Requirements Mapped to the Packet Filter
Step Accomplished through
1 The path to which you assign the packet filter. For administrative
purposes, this path is specified in the first two comment lines in the filter
definition. The filter must be assigned to a multicast path to filter packets
that have broadcast addresses.
2 Packet Filter One — Forwarding XNS packets
3 Packet Filter Two — Looking for specified socket range
4 & 5 Combining a Subset of Filters — Forwarding IP packets within specified
socket range