•Fwd: Shows whether the filter forwards (Yes) a packet or discards (No) it when there’s a match.
•
•
•
•
•Protocol: The protocol to match. This can be entered as a number (see the table below) or as TCP or UDP if those protocols are used.
Protocol | Number to use | Full name |
|
|
|
|
|
|
N/A | 0 | Ignores protocol type |
|
|
|
ICMP | 1 | Internet Control Message Protocol |
|
|
|
TCP | 6 | Transmission Control Protocol |
|
|
|
UDP | 17 | User Datagram Protocol |
|
|
|
•Src Port: The source port to match. This is the port on the sending host that originated the packet.
•Dst Port: The destination port to match. This is the port on the receiving host for which the packet is intended.
•NC: Indicates No Compare, where specified.
Filtering example #1
Returning to our filtering rule example from above (see page 157), look at how a rule is translated into a filter. Start with the rule, then fill in the filter’s attributes:
•The rule you want to implement as a filter is:
“Block all Telnet attempts that originate from the remote host 199.211.211.17.”
•The host 199.211.211.17 is the source of the Telnet packets you want to block, while the destination address is any IP address. How these IP addresses are masked deter- mines what the final match will be, although the mask is not displayed in the table that displays the filter sets (you set it when you create the filter). In fact, since the mask for the destination IP address is 0.0.0.0, the address for Destination IP address could have been anything. The mask for Source IP address must be 255.255.255.255 since an exact match is desired.
