|
|
|
|
| Introduction to Filtering | |||
The following operators are used in creating Pattern filters. |
|
| ||||||
- | offset | Used | in pattern filters |
| to determine | the starting | ||
|
| position to start the pattern checking. |
|
| ||||
| Example: | This filter pattern will match | ||||||
|
|
|
| if | the | packet | information | |
|
|
|
| starting at the 12th | octet | |||
|
|
|
| equals the 80 of the filter | ||||
|
|
|
| pattern. |
|
|
| |
OR | Used in combination filters when one or the other | |||||||
|
| conditions must be met. |
|
|
|
|
| |
| Example: | This filter pattern will match | ||||||
|
|
|
| if | the | packet | information | |
|
|
|
| starting at the 10th | octet | |||
|
|
|
| equals the 20 of the filter | ||||
|
|
|
| pattern or if the packet | ||||
|
|
|
| information starting | at the | |||
|
|
|
| 12th octet equals the 80 of | ||||
|
|
|
| the filter pattern. |
|
| ||
& | AND | Used in combination filters when one and the other | ||||||
|
| conditions must be met. |
|
|
|
|
| |
| Example: | This filter pattern will match | ||||||
|
|
|
| if | the | packet | information | |
|
|
|
| starting at the 10th | octet | |||
|
|
|
| equals the 20 of the filter | ||||
|
|
|
| pattern | and | the | packet | |
|
|
|
| information starting | at the | |||
|
|
|
| 12th octet equals the 80 of | ||||
|
|
|
| the filter pattern. |
|
| ||
~ | NOT | Used in pattern filters to indicate that all packets not | ||||||
|
| matching the defined pattern will be filtered. |
| |||||
| Example: | This filter pattern will match | ||||||
|
|
|
| if | the | packet | information | |
|
|
|
| starting at the 12th octet | ||||
|
|
|
| does not equal the 80 of the | ||||
|
|
|
| filter pattern. |
|
|
59