Enterasys Networks ENTERASYS ATX manual Using ATX Port Filtering

Using ATX Port Filtering

4.) Select FRAME if you want the field offset value relative to the end of the Ethernet frame type (regardless of whether or not the frame type is SNAP encapsulated). For example, for IP packets, a field offset of 0 indicates the start of the IP header.

e.If you want to use a data mask, click in the Mask: text box and type in an eight octet hexadecimal mask that will be applied to the eight octets within the packet before they are compared to the specified field value. Use an F in the bitmask where you want to indicate an exact match to the corresponding data field value; use a 0 in the bitmask to indicate a “don’t care” bit.

f.To enter the Value that the filter will use when comparing packet data for a match, click in the text box, and enter the hexadecimal field value of the eight octets (beginning at the Offset from the specified Origin). Do not use separators between each octet.

Each octet must be represented by a two digit hexadecimal value. For example, if you were searching for a MAC address, you must enter each bit in the address (00001d01020A, as opposed to 001d12A).

8.To use a packet’s protocol type as the filtering criteria:

a.Click the Frame Protocol selection box.

b.Indicate whether you want the specified protocol type to be exclusive or inclusive for filtering purposes.

1.) Click to activate (highlight) the Don’t Match check box if you want to filter on any packet that is not of the selected protocol type.

2.) Click to de-activate (gray-out) the Don’t Match check box if you want to filter on packets that are of the selected protocol type. This is the default.

c.Click on the Protocol menu button, and drag to select the appropriate protocol type: any-802, any-ethernet, Appletalk, Banyan, DECnet Phase IV, IP, Novell 1, Novell 2, XNS, Cabletron, Enterasys, or Other.

If you select one of the provided protocol types, its hexadecimal identifier will appear in the Number (hex) text field (e.g., Appletalk=809b).

If you select Other, you can use the Number (hex) text field to enter the hexadecimal identifier of the protocol type of your choice.

9.With the Filter Alarm parameters, you can configure the ATX to issue a trap when a defined threshold of packets matching this filter’s parameters has been exceeded within a specified interval.

a.Click in the Interval: text box, and enter the number of seconds during which the specified threshold must be exceeded for a trap to be issued. The range is from 0–3600 (1 hour), where 0 indicates no trap should be generated.

Editing the Port Filters Table 4-9