Product Info

Infinet Wireless: Technical Documentation – InfiMAN Evolution
Operation & Administration – 118
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Qualifier Description
type Qualifiers say to what the id name or number refers to
Possible types are: host, net, port, portrange
For example: “host foo”, “net 128.3”, “port 20”, “portrange 6000-6008”
If there is no type qualifier, host is assumed
dir Qualifiers specify a particular transfer direction to and/or from id
Possible directions are: src, dst, src or dst and src and dst
For example, “src 1.1.1.1”, “dst net 128.3”, “src or dst port 21”. If there is no
dir qualifier, src or dst is assumed
proto Qualifiers restrict the match to a particular protocol
Possible protos are: ether, ip, ip6, arp, rarp, tcp and udp
For example: “ether src 00:12:13:14:15:16”, “arp net 128.3”, “tcp port 21”,
“udp portrange 7000-7009”
If there is no proto qualifier, all protocols consistent with the type are
assumed
For example, “src 1.1.1.1” means “(ip or arp or rarp) src foo” (except the
latter is not legal syntax), “net 1.2.3.0/24” means “(ip or arp or rarp) net
1.2.3.0/24” and “port 53” means “(tcp or udp) port 53”
18 Table - Qualifiers
More complex filter expressions are built up by using the words “and”, “or” and “not” to combine primitives. For
example: “host foo and not port ftp and not port ftp-data”. To save typing time, identical qualifier lists can be
omitted. For example: “tcp dst port ftp or ftp-data or domain” is exactly the same as “tcp dst port ftp or tcp dst port
ftp-data or tcp dst port domain”.
Allowable primitives are:
Primitives Description
dst host host True if the IPv4 destination field of the packet is "host", which may be
either an address or a name
src host host True if the IPv4 source field of the packet is "host"
host host True if either the IPv4 source or destination of the packet is host
Any of the above host expressions can be prefixed with the keywords,
ip, ip6, arp, rarp as in: “ip host host”
This is equivalent to: “ether proto \ip and host host”
ether dst ehost True if the Ethernet destination address is "ehost"
Ehost must have a numeric format: XX:XX:XX:XX:XX:XX
ether src ehost True if the Ethernet source address is "ehost"
ether host ehost True if either the Ethernet source or destination address is "ehost"