Programmable Filtering
55
IP, and no more
This example performs just the opposite function to the above example. Only IP packets will be allowed to be
passed across the bridged network.
For this function there must be a method to prevent all but IP packets from being filtered. For this the NOT (“~”)
logical operator is used. The NOT operator specifies that the expression has to be FALSE before the frame is
filtered. In other words, only frames that are NOT equal to the expression will be filtered and discarded.
To create this mask, the following expression is entered:
~(12-0800)
The parenthesis simply ensures that the NOT operator will apply to the entire expression.
In this case, whenever a frame is received, the frame will be filtered if the protocol type is NOT equal to 0800 (IP).
Only one filter pattern may be used that contains the NOT operator.
Transport Control Protocol / Internet Protocol (TCP/IP)
The previous example showed how to filter all Ethernet frames that contained an IP protocol packet. However, IP is
used as the Network-layer protocol for more than 40 different Transport-layer protocols, TCP being only one of
them. Therefore, with the mask that was used as noted in the previous IP example, all Transport layer protocols that
used IP would also be filtered. This may not be desirable in all cases.
For this example, the discrimination of the Transport Layer used within an IP packet will be demonstrated. This
requires an AND function, since we want to filter data that both is IP and contains TCP information.
Within the IP frame, there is a single octet field that may be used to indicate the protocol of the Transport layer, or
the protocol of the data in the IP packet. If TCP were the protocol within the IP packet, this octet, or 8-bit byte,
would be equal to 6.
The location of this field, remembering that the start of the Ethernet frame is always the base reference, is octet 23.
Filter only TCP/IP
To filter only those packets that are TCP/IP, the mask would therefore be:
12-0800&23-06
The 12-0800 is the IP expression and the 23-06 will represent TCP in an IP frame. The “&” is the logical AND
operator, so the expression requires that the frame be both an IP and TCP.
Filter all IP without TCP traffic
To filter all IP packets that do not contain TCP traffic, the mask would be:
12-0800&~(23-06)
Filter all except TCP/IP
To filter all other packets except TCP/IP packets, the mask would be:
~(12-0800&23-06)
