User`s guide

5-12

Filters

Field Origin

Either IP, MAC, or SR (see Field Offset below). The origin is the

ﬁeld from which the offset count starts. IP is the default.

Field Offset

The decimal offset of the portion of the packet (as stored in

canonical format) to be examined. If the origin is IP, then the offset

is relative to the end of the IP Header (an offset of zero indicates

the portion immediately following the end of the IP Header). If the

origin is MAC, then the offset is relative to the beginning of the

canonical format MAC addresses (an offset of zero indicates the

start of the destination MAC address). If the origin is SR, then the

offset is relative to the end of the MAC header, including the SR

header if present. Zero is the default.

Note: The canonical format is described in Appendix B, Packet

Translation Procedure, of this manual.

Field Value

The hexadecimal value of the eight octets beginning at the origin

and offset by the value speciﬁed above. The octets must be

separated by spaces. This is the value that the ﬁlter is using when it

does a comparison for a match, for example a MAC address.

Field Mask

An eight octet mask applied to the packet’s eight octets before

comparing them to the Field Value speciﬁed above. The mask

octets must be separated by spaces. This is a mask of the speciﬁed

Field Value.

Threshold Time

Number of seconds for which the threshold packet count applies.