User`s guide

4-1
Chapter 4
Using ATX Port Filtering
Port filter table information; adding filters; viewing statistics
The ATX lets you create custom filters to screen data packets, and discard or
forward traffic based on the specified filter criteria. You may have several reasons
for creating filters — for example, to monitor traffic patterns as an aid to
optimizing your network design, or to evaluate your network security. Among
the criteria you can select for filtering are the packet’s source or destination
address, its entry or exit port, the packet’s Protocol type, or a 64 byte data value
filter applied anywhere in the packet’s data.
The ATX supports two basic types of filters:
• Entry filters are pre-processing filters, applied to a port to screen incoming
traffic.The filterconditionis satisfied beforea bridgingdecisionis made atthe
port.Youcanusethisfiltertoblockincomingtrafficfromaparticularsegment,
for instance.
• Exit filters are post-processing filters. The packet is received and processed at
aport,and then screenedafterabridging decision ismade at theport.Youcan
use this filterto allowtrafficto be forwarded froma segment tosome portson
a bridge, but not to others, for example.
There are two basic methods of determining how packets get filtered:
• Bridge Address Table filters are created in the Bridge Filtering Database, and
are based on the address information stored in the bridge’s Source Address
Table. They let you screen packets on any source address that is recorded as a
static or dynamic entry in the bridge’s Source Address Table. The Source
Address Table can store up to 8,192 entries, of which 200 can be statically
createdthroughmanagement.Byusingthesefilters,youcanselectively screen
trafficto orfroma particular station according to its MACaddress, or filteron
multicastpackets—suchastheFF-FF-FF-FF-FF-FFbroadcastMACaddress—
transmitted from a particular source address (to prevent broadcast storms
from propagating over the network from that source).