Motorola 2200, 7000, 3352N, 3342 manual How filter sets work, Filter priority, 164

Administrator’s Handbook

How filter sets work

A filter set acts like a team of customs inspectors. Each filter is an inspector through which incoming and outgoing packages must pass. The inspectors work as a team, but each inspects every package individu- ally.

Each inspector has a specific task. One inspector’s task may be to examine the destination address of all outgoing packages. That inspector looks for a certain destination—which could be as specific as a street address or as broad as an entire country—and checks each package’s destination address to see if it matches that destination.

A filter inspects data packets like a customs inspector scrutinizing packages.

INSPECTOR

FROM:

APPROVET : D

FROM:

TO:

FROM:

TO:

Filter priority

Continuing the customs inspectors analogy, imagine the inspectors lined up

packet		to examine a package. If the package matches the first inspector’s criteria,
		the package is either rejected or passed on to its destination, depending on
		the first inspector’s particular orders. In this case, the package is never
		seen by the remaining inspectors.
first
filter	no	If the package does not match the first inspector’s criteria, it goes to the
match?
		second inspector, and so on. You can see that the order of the inspectors in
	send	the line is very important.
	to next
yes	filter	For example, let’s say the first inspector’s orders are to send along all pack-
		ages that come from Rome, and the second inspector’s orders are to reject
		all packages that come from France. If a package arrives from Rome, the
		first inspector sends it along without allowing the second inspector to see it.
forward		A package from Paris is ignored by the first inspector, rejected by the second
or		inspector, and never seen by the others. A package from London is ignored
discard? discard
		by the first two inspectors, so it’s seen by the third inspector.
	(delete)
forward		In the same way, filter sets apply their filters in a particular order. The first fil-
		ter applied can forward or discard a packet before that packet ever reaches
to network		any of the other filters. If the first filter can neither forward nor discard the
		packet (because it cannot match any criteria), the second filter has a chance
		to forward or reject it, and so on. Because of this hierarchical structure,

each filter is said to have a priority. The first filter has the highest priority, and the last filter has the lowest priority.

164