When you use the log option, the CP processor logs details the packets that match. Depending on how many packets match the log entry and at what rate, the CP may become busy as it has to log these packets’ details.

deny tcp

Configure a filter that drops transmission control protocol (TCP) packets meeting the filter criteria.

Syntaxdeny tcp {source mask any host ip-address} [bit] [operator port [port]] {destination mask any host ip-address} [dscp] [bit] [operator port [port]] [count [byte] [order] [fragments]

To remove this filter, you have two choices:

•Use the no seq sequence-numbercommand if you know the filter’s sequence number.

•Use the no deny tcp {source mask any host ip-address} {destination mask any host ip-address} command.

Parameters

source

Enter the IP address of the network or host from which the

 

 

 

packets are sent.

 

mask

Enter a network mask in /prefix format (/x) or A.B.C.D. The

 

 

mask, when specified in A.B.C.D format, may be either

 

 

contiguous or non-contiguous.

 

any

Enter the keyword any to specify that all routes are subject

 

 

to the filter.

 

host ip-address

Enter the keyword host then the IP address to specify a host

 

 

IP address.

 

dscp

Enter this keyword dscp to deny a packet based on the

 

 

DSCP value. The range is from 0 to 63.

 

bit

Enter a flag or combination of bits:

 

 

•

ack: acknowledgement field

 

 

• fin: finish (no more data from the user)

 

 

•

psh: push function

 

 

• rst: reset the connection

 

 

• syn: synchronize sequence numbers

 

 

•

urg: urgent field

 

operator

(OPTIONAL) Enter one of the following logical operand:

 

 

• eq = equal to

 

 

• neq = not equal to

 

 

• gt = greater than

 

 

• lt = less than

• range = inclusive range of ports (you must specify two ports for the port command)

202

Access Control Lists (ACL)

Page 202
Image 202
Dell 9.7(0.0) manual Deny tcp, Bit, Operator