12-16 CHAPTER 12: CREATING AND USING PACKET FILTERS

Combining a Subset of the Filters. The next filter accepts IP packets with a socket range of 0x76c (1900) and 0x898 (2200). The filter combines packet filters one and two, modifying them for IP. These steps show how to create this filter.

1Name the filter:

“Only IP pkts w/in socket range”

2Perform steps 2 through 4 as described in “Packet Filter One” on page 12-14, except give the pushLiteral instruction (in step 3) a value of 0x0800 for IP.

3Perform steps 2 through 8 as described in “Packet Filter Two” on page 12-15, except the socket value for IP (in step 3) is located 24 bytes into the packet (instead of 30 as for XNS).

4Add an and statement to compare the results of step 2 with the results of step 3:

and # compare if IP and in range

This combination looks like this:

Name

“Only IP pkts w/in socket range”

pushField.w

12

# get the type field of the packet and

 

 

 

# place it on top of the stack

pushLiteral.w

0x0800

# put the type value for IP on top of

 

 

 

# the stack

eq

 

 

# if the two values on the top of the

 

 

 

# stack are equal, then return a non-zero

 

 

 

# value

pushLiteral.w

0x76c

# put the lowest socket value on top of

 

 

 

# the stack (1900)

pushField.w

24

# put the value of the socket from the

 

 

 

# packet on top of the stack

ge

 

 

# compare if the value of the socket is

 

 

 

# greater than or equal to the lower bound

pushLiteral.w

0x0898

# put the highest socket value on top of

 

 

 

# the stack (2200)

pushField.w

24

# put the value of the socket from the

 

 

 

# packet on top of the stack

lt

 

 

# compare if the value of the socket is

 

 

 

# less than the upper bound

and

 

 

# “and” together with “ge” and “lt” test

 

 

 

# to determine if the socket value is

 

 

 

# “within” the range. If it is in range, a

 

 

 

# “one” will be placed on the stack.

and

 

 

# compare if IP and in range

Page 153
Image 153
3Com 2200 manual This combination looks like this, Only IP pkts w/in socket range