Net Optics Director manual Understand filter interactions, Cam

Director

Understand filter interactions

It is important to understand that Director uses Content Addressable Memory (CAM) technology to implement filters. As each filter is defined, it is stored in the next available entry in the CAM. Each packet header is compared in the CAM, and the CAM returns the index of the first filter that the packet header matched. That filter, and only that filter, controls which monitoring ports receive a copy of the packet. Other filters are not executed for that packet. Therefore, filters are not completely independent; one filter can affect the operation of another.

Let's walk through an example of a filter interaction that may be unexpected. First, we will set up a filter for an IP address:

filter add in_ports=n1.5 ip_src=192.186.10.0 action=redir redir_ports=m.1 filter commit

Source IP =

Network Port 5 192.168.10.0 - Monitor Port 1

192.168.10.15

	CAM
Address	Filter
1	n1.5 ip_src=192.186.10.0 m.1

￿lter add in_ports=n1.5 ip_src=192.168.10.0 ip_src_mask=255.255.255.240 action=redir redir_ports=m.1

Figure 34: A simple IP address filter, shown with CAM

All traffic from Network Port 5 that comes from IP address 192.186.10.0 matches the first CAM entry and therefore is copied to Monitor Port 1.

Next, suppose we want another monitoring tool to see all the TCP traffic from Network Port 5, so we set up this filter:

filter add in_ports=n1.5 ip_proto=6 action=redir redir_ports=m.2 filter commit

Network Port 5

Source IP =	Monitor Port 1
192.186.10.0
	Filter interactions
Protocol =	are not shown!
	Monitor Port 2
TCP

CAM

Address Filter

1n1.5 ip_src=192.186.10.0 m.1

2n1.5 ip_proto=TCP m.2

￿lter add in_ports=n1.5 ip_src=192.186.10.0 action=redir redir_ports=m.1 ￿lter add in_ports=n1.5 ip_proto=6 action=redir redir_ports=m.2

Figure 35: Incorrect flow diagram of two filters; filter interaction in CAM is neglected

33