Black Box LR5100A-T, LR5200A-R2 Pattern Filtering, Introduction to Filtering, 10-20&12-80

Introduction to Filtering

Pattern Filtering

Pattern filtering is provided in three separate sections: Bridge Pattern Filters, IP Router Pattern Filters, and IPX Router Pattern Filters. When the router is operating as an IP/IPX Bridge/Router, each of the frames received is passed on to the appropriate internal section of the router. The IPX frames are passed on to the IPX router, the IP frames are passed on to the IP router, and all other frames are passed on to the bridge. Different pattern filters may be defined in each of these sections to provide very extensive pattern filtering on LAN traffic being sent to remote LANs.

Pattern filters are created by defining an offset value and a pattern match value. The offset value determines the starting position for the pattern checking. An offset of 0 indicates that the pattern checking starts at the beginning of the data frame. An offset of 12 indicates that the pattern checking starts at the 12th octet of the data frame. When a data frame is examined in its HEX format, an octet is a pair of HEX values with offset location 0 starting at the beginning of the frame. Please refer to Appendix C - Octet Locations on Ethernet Frames for more information on octet locations in data frames.

The pattern match value is defined as a HEX string that is used to match against the data frame. If the HEX data at the appropriate offset location in the data frame matches the HEX string of the filter pattern, there is a positive filter match. The data frame will be filtered according to the filter operators being used in the filter pattern.

The following operators are used in creating Pattern filters.

-	offset	Used in pattern filters to determine the starting position to start the pattern
		checking.
	Example:		12-80	This filter pattern will match if the packet
				information starting at the 12th octet equals the 80
				of the filter pattern.
	OR	Used in combination filters when one or the other conditions must be met.
	Example:		10-2012-80	This filter pattern will match if the packet
				information starting at the 10th octet equals the 20
				of the filter pattern or if the packet information
				starting at the 12th octet equals the 80 of the filter
				pattern.
&	AND	Used in combination filters when one and the other conditions must be
		met.
	Example:		10-20&12-80	This filter pattern will match if the packet
				information starting at the 10th octet equals the 20
				of the filter pattern and the packet information
				starting at the 12th octet equals the 80 of the filter
				pattern.
~	NOT	Used in pattern filters to indicate that all packets not matching the defined
		pattern will be filtered.

60