Filter Example

A filter for blocking a specific MAC address

This configuration example will show you how to use a Generic Filter to block a specific MAC address on the LAN.

Before you Begin

Before you configure the filter you need to know the MAC address of the client. The MAC address can be provided by the NICs. If there is the LAN packet passing through the Prestige you can identify the MAC address from the Prestige's LAN packet trace. Please look at the following example to know the trace of the LAN packets.

`ras> sys trcp channel enet0 bothway` `ras> sys trcp sw on` `Now a client on the LAN is trying to ping Prestige………` `ras> sys trcp sw off` `ras> sys trcp disp` `TIME: 37c060 enet0-RECV len:74 call=0` `0000: [00 a0 c5 01 23 45] [00 80 c8 4c ea 63] 08 00 45 00` `0010: 00 3c eb 0c 00 00 20 01 e3 ea ca 84 9b 5d ca 84` `0020: 9b 63 08 00 45 5c 03 00 05 00 61 62 63 64 65 66` `0030: 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76` `0040: 77 61 62 63 64 65 66 67 68 69` `TIME: 37c060 enet0-XMIT len:74 call=0` `0000: [00 80 c8 4c ea 63] [00 a0 c5 01 23 45] 08 00 45 00` `0010: 00 3c 00 07 00 00 fe 01 f0 ef ca 84 9b 63 ca 84` `0020: 9b 5d 00 00 4d 5c 03 00 05 00 61 62 63 64 65 66` `0030: 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76` `0040: 77 61 62 63 64 65 66 67 68 69`

The detailed format of the Ethernet Version II:

`+ Ethernet Version II` `- Address: 00-80-C8-4C-EA-63 (Source MAC) ----> 00-A0-C5-23-45` `(Destination MAC)` `- Ethernet II Protocol Type: IP` `+ Internet Protocol` `- Version (MSB 4 bits): 4` `- Header length (LSB 4 bits): 5` `- Service type: Precd=Routine, Delay=Normal, Thrput=Normal, Reli=Normal` `- Total length: 60 (Octets)` `- Fragment ID: 60172` `- Flags: May be fragmented, Last fragment, Offset=0 (0x00)` `- Time to live: 32 seconds/hops` `- IP protocol type: ICMP (0x01)` `- Checksum: 0xE3EA` `- IP address 202.132.155.93 (Source IP address) ---->` `202.132.155.99(Destination IP address)` `- No option` `+ Internet Control Message Protocol` `- Type: 8 - Echo Request` `- Code: 0` `- Checksum: 0x455C` `- Identifier: 768` `- Sequence Number: 1280` `- Optional Data: (32 bytes)`

- Configurations

From the above first trace, we know that a client is trying to ping the Prestige router. And from the second trace, we know that the Prestige router will send a reply to the client accordingly. The following sample filter will utilize the 'Generic Filter Rule' to block the MAC address [00 80 c8 4c ea 63].

1. First, from the incoming LAN packet we know that the unwanted source MAC address starts at the 7th Octet

`TIME: 37c060 enet0-RECV len:74 call=0` `0000: [00 a0 c5 01 23 45] [00 80 c8 4c ea 63] 08 00 45 00` `0010: 00 3c eb 0c 00 00 20 01 e3 ea ca 84 9b 5d ca 84` `0020: 9b 63 08 00 45 5c 03 00 05 00 61 62 63 64 65 66` `0030: 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76` `0040: 77 61 62 63 64 65 66 67 68 69`

2. We are now ready to configure the 'Generic Filter Rule' as below.

`Menu 21.1.1 - Generic Filter Rule` `Filter #: 1,1` `Filter Type= Generic Filter Rule` `Active= Yes` `Offset= 6` `Length= 6` `Mask= ffffffffffff` `Value= 0080c84cea63` `More= No Log= None` `Action Matched= Drop` `Action Not Matched= Forward`

Key Settings:

- Filter Type: Set the 'Filter Type' to 'Generic Filter Rule'.
- Active: Turn 'Active' to 'Yes'
- Offset (in bytes): Set to '6' since the source MAC address starts at 7th octets we need to skip the first octets of the destination MAC address.
- Length (in bytes): Set to '6' since MAC address has 6 octets.
- Mask (in hexadecimal): Specify the value that the Prestige will logically qualify (logical AND) the data in the packet. Since the Length is set to 6 octets the Mask for it should be 12 hexadecimal numbers. In this case, we intent to set to 'ffffffffffff' to mask the incoming source MAC address, [00 80 c8 4c ea 63].
- Value (in hexadecimal): Specify the MAC address [00 80 c8 4c ea 63] that the Prestige should use to compare with the masked packet. If the result from the masked packet matches the 'Value', then the packet is considered matched.
- Action Matched= : Enter the action you want if the masked packet matches the 'Value'. In this case, we will drop it.
- Action Not Matched= : Enter the action you want if the masked packet does not match the 'Value'. In this case, we will forward it. If you want to configure more rules please select 'Check Next Rule' to start configuring the next new rule. However, please note that the 'Filter Type' must be also 'Generic Filter Rule' but not others. Because the Generic and TCP/IP (IPX) filter rules must be in different filter sets.

`Menu 21.1.2 - Generic Filter Rule` `Filter #: 1,2` `Filter Type= Generic Filter Rule` `Active= Yes` `Offset= 6` `Length= 6` `Mask= ffffffffffff` `Value= 0080c810234a` `More= No Log= None` `Action Matched= Drop` `Action Not Matched= Forward`

You can now apply it to the 'General Ethernet Setup' in Menu 3.1. Please note that the 'Generic Filter' can only be applied to the 'Device Filter' but not the 'Protocol Filter' that is used for configuring the TCPIP and IPX filters.

`Menu 3.1 - General Ethernet Setup` `Input Filter Sets:` `protocol filters=` `device filters= 1` `Output Filter Sets:` `protocol filters=` `device filters=`

All contents copyright © 1999 ZyXEL Communications Corporation.