SYN flag valid, use code 2 2
Both SYN and ACK valid, use code 18 18
SYN valid and ACK invalid, use code 2 18
Example – Address filters
This example allows all packets to pass through the filter by permitting any protocol type, and using a null address and network mask for both the source address and destination address.
Console(config)#ip filter permit any 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
Console(config)#
This accepts any incoming packets if the source address is within subnet 10.7.1.x. For example, if the rule is matched; that is, the rule (10.7.1.1 & 255.255.255.0) equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through.
Console(config)#ip filter permit any 10.7.1.1 255.255.255.0
0.0.0.00.0.0.0
Console(config)#
Example – Checking for fragments
This example blocks all fragments and logs the matching packets in the log.
Console(config)#ip filter deny any 0.0.0.0 0.0.0.0 0.0.0.0
0.0.0.0fragment log
Console(config)#
Example – Checking for code values
This blocks all TCP packets from class C addresses 192.168.1.0 with SYN set.
Console(config)#ip filter deny tcp 192.168.1.0 255.255.255.0
0.0.0.00.0.0.0 code syn Console(config)#
