A-2 APPENDIX A: PACKET FILTER OPCODES, EXAMPLES, AND SYNTAX ERRORS

pushField.size <offset>

Description:

Pushes a field from the target packet onto the stack. Packet data starting at <offset> is copied onto the stack. The most significant byte of the field is the byte at the specified offset. The number of bytes pushed is determined by the size field of the instruction. The pushField instruction provides direct access to any 1, 2, 4, or 6 byte field contained within the first 65535 bytes of the target packet.

Certain implementations of the packet filter language further limit the maximum offset, based on the packet lengths supported by the underlying network. Ethernet-based packet filters are limited to accessing fields in the first 1518 bytes of the target packet.

Specify the offset as either an octal, decimal, or hexadecimal number.

Precede an octal number by a “0”.

Precede a hexadecimal number by either “0x” or “0X”.

Use either upper or lower case letters for the hexadecimal digits “a” through “f”.

Storage Needed:

3 bytes

pushLiteral.size <value>

Description:

Pushes a literal constant <value> onto the stack. The most significant byte of the <value> is the first byte of the literal. Bytes are copied directly from the instruction stream onto the stack. The number of bytes pushed is determined by the size field of the instruction.

Specify the value as either an octal, decimal, or hexadecimal number.

Precede an octal number by a “0”.

Precede a hexadecimal number by either “0x” or “0X”.

Use either upper or lower case letters for the hexadecimal digits “a” through “f”.

Storage Needed:

1 (.b), 2 (.w), 4 (.l), or 6 (.a) bytes—depending on the size of the operand

Page 176
Image 176
3Com 2200 manual PushField.size offset, Bytes PushLiteral.size value