Owner's Manual

471
- Fragment Offset —Enter a value under the table and click Add.
- Icmp code —Select a value from the pick list and click Add. Values include communication-
prohibited-by-filter, destination-host-prohibited, destination-host-unknown, destination-
network-prohibited, destination-.network-unknown, host-precedence violation, host-
unreachable, host-unreachable-for-tos, ip-header-bad, network-unreachable, network-
unreachable-for-tos, port-unreachable, precedence-cutoff-in-effect, protocol unreachable,
redirect-for-host, redirect-for-network, redirect-for-tos-and-host, redirect-for-tos-and-net,
required-option-missing, source-host-isolated, source-route-failed, tti-eq-zero-during-
reassembly, tti-eq-zero-during-transit.
- Icmp type —Select a value from the pick list and click Add. Values include echo-reply, echo-
request, info-reply, info-request, mask-request, mask-reply, parameter-problem, redirect,
router-advertisement, router-solicit, source-quench, time-exceeded, timestamp, timestamp-
reply, unreachable.
- Packet length —Enter a value under the table and click Add.
-
Precedence —Select a value from the pick list and click Add. Values include critical-ecp, flash,
flash-override, immediate, internet-control, net-control, priority, routine.
- Protocol —Select a value from the pick list and click Add. Values include ah, dstopts, egp, esp,
fragment, gre, hop-by-hop, icmp, icmpv6, igmp, ipip, ipv6, no-next-header, ospf, pim, routing,
rsvp, sctp, tcp, udp, vrrp.
- Forwarding-class —Select a value in the pick list under the table and click Add. See Class of
Service -> Forwarding Classes on page 445 for the origin of this list.
-
Except —When checked, means “Match anything but this criterion.”
-
TCP Flag —Bit-field filter conditions match packet fields if particular bits in those fields are or
are not set. You can match the IP options, TCP flags, and IP fragmentation fields. For bit-field
filter match conditions, you specify a keyword that identifies the field and tests to determine
that the option is present in the field. See the table Bit-Field Firewall Filter Match Conditions
on page 472
NOTE:
NOTE: This software does not automatically check the first fragment bit when matching TCP flags.
To specify the bit-field value to match, enter it in the TCP Flags field. For example, a match
occurs if the RST bit in the TCP flags field is set:
rst
Generally, specify the bits being tested using keywords. Bit-field match keywords always map
to a single bit value. You also can specify bit fields as hexadecimal or decimal numbers. To
negate a match, precede the value with an exclamation point. For example, a match occurs
only if the RST bit in the TCP flags field is not set:
!rst