Create Complex Filters | Net Optics none specs

Director

•	ip_dst	IP destination address
• ip_dst_mask		IP source address mask
•	ip_proto	IP protocol
• l4_src_port		Layer 4 source port
• l4_dst_port		Layer 4 destination port
•	vlan	VLAN number

Create Complex Filters

Multiple filter parameters can be specified in a single filter add command. Packets must satisfy all of the filter parameters to be selected; in other words, the filter parameters have a logical AND connection.

To select all TCP traffic arriving from IP address 192.186.10.0:

1.Enter filter add in_ports=n1.5 ip_src=192.186.10.0 ip_proto=6 action=redir redir_ports=m.1. A filter has been defined to select all IPv4 TCP packets from Network Port 5 with a source IP address of 192.186.10.0; packets matching the filter are copied to Monitor Port 1.

2.Enter filter commit. The filter is activated.

Network Port 5		Source IP =		Protocol =		Monitor Port 1
Network Port 5	192.186.10.0			TCP		Monitor Port 1
	192.186.10.0			TCP

lter add in_ports=n1.5 ip_src=192.186.10.0 ip_proto=6 action=redir redir_ports=m.1

Figure 28: Logical AND filter connection

A logical OR connection can be made between filters by specifying multiple filters with the same Network and Monitor port lists.

To select all packets which are either TCP or UDP protocol:

1.Enter filter add in_ports=n1.5 ip_proto=6 action=redir redir_ports=m.1. A filter has been defined to select all IPv4

TCP packets from Network Port 5 and copy them to Monitor Port 1.

2.Enter filter add in_ports=n1.5 ip_proto=17 action=redir redir_ports=m.1. Another filter has been defined to select all IPv4 UDP packets from Network Port 5 and copy them to Monitor Port 1.

3.Enter filter commit. The filters are activated.

29

*** Confidential - DO NOT Distribute ***

Image 33

Net Optics none manual Create Complex Filters, Logical and filter connection

Contents

Smart Filtering Appliance Trademarks and Copyrights Contents Appendix B Appendix aAppendix C Filter parameters Chapter Introduction Ease of Use Key FeaturesMonitor port Filtering Passive, Secure Technology Description About this Guide Director internal architecture Director Architecture Director Management USB port Network Links Typical Application Monitoring Tools IBypass Switch Method In-line Monitoring of 10 Gigabit LinksExternal Network Tap method Director Front Panel Power LEDsMonitor Port LEDs DNM / Network Port LEDs XFP Director Rear Panel Chapter Installing Director Unpack and Inspect the Director device Plan the Installation Install Director Network Modules Install SFP and XFP Monitor port ModulesRack Mount the Director device Connect the local CLI Interface Connect Power to Director Baud Data bits No parity 1 stop bit No flow control Connect the remote CLI InterfaceTip To connect the CLI for remote use over the Management port To log into the CLI Log into the CLI Configure Director using the CLI Change Director User Name and PasswordTo change the user name and password Assign a New Manager IP Address To change the port modeTo assign a new Manager IP address to Director Change Port Modes Set the Current Date and Time Save and Load Director Configurations To view CLI help information Using the CLI Help Command Current config file Using the CLI Command History Buffer To connect a Span port Connect Span Ports to Director To connect an in-line network link Connect Director With In-line Network Links Configure a Matrix Switch connection in Director Check the InstallationConnect Monitoring Tools to Director Syntax Chapter Configuring Filters Using the CLI Copy Traffic From Any Network Port to Any Monitor Port Enter filter commit. The switch connection is activated Lter add inports=n1.1 action=redir redirports=m.3-m.5 Regenerate Traffic to Any Set of Monitor Ports To create a filter that selects IPv4 packets by protocol Create Filters Logical and filter connection Create Complex Filters UDP View filters Configurable 10 Gigabit XFP ports used as Network ports Work with configurable 10 Gigabit ports Network Port 11 XFP Port CAM Understand filter interactions Flow diagram now looks as follows N1.1 ipproto=UDP action=drop N1.1 m.1 Exclusive filters Understand pending and active filters To change the Director filter configuration Enter filter list to view the pending filter list Filter capacity User interactions Daisy-chaining Multiple Director Chassis Specifications, chassis Appendix a Director Specifications Environmental Specifications, DNMCertifications Available Models Command Sub-Command Parameters Example and description Appendix B Command Line Interface Filter add and filter ins commands Command may includeFilter add ipv6=n inports=n1.1-n1.3 ip Src=10.1.1.1 action=drop Filter list Load myconfiguration-1Filter running Filter sync Show myconfiguration-1 Save myconfiguration-1Passwd Ping Sysip ipaddr=192.168.1.2 netmask=255.255.0.0 Sysip commitSysip show Time User show This This command is only available at root level CommandUser add name=bob pw=bob-pw priv=3 Is only Director Filter Parameters Qual Value Example Description Filter parameters Num Keyword Protocol Appendix C Protocol Numbers Mobile L2TP Limitations on Warranty and Liability By Net Optics, Inc. All Rights Reserved