HP-UX Reference (11i v1 05/09) - 4 File Formats (vol 8)

p
ppp.Filter(4) ppp.Filter(4)
NAME
ppp.Filter - PPP packet filter specification file format
DESCRIPTION
The file /etc/ppp/Filter
describes how on-demand PPP links are to be managed. By default, any
type of packet causes the link (if down) to be brought up (connected to its remote end); any packet is
allowed to traverse the link; and any packet is sufficient to reset the idle timer, expiration of which would
cause the link to be shut down. This combination is not always appropriate behavior, so the filter file
allows individual control based on the packet type and its source or destination. These selection criteria
may be specified for any of the three phases of operation: bringing up the link, passing packets on the link,
and shutting down the link due to inactivity. Packet logging detail may also be selected using the same cri-
teria.
Format
Comments begin with a ‘#’ and extend to the end of the line; blank lines, or lines beginning with a ‘#’, are
ignored. Upper/lower case distinctions are ignored in hostname specifications, but are significant else-
where. Fields are separated by horizontal or vertical white space (blanks or tabs or newlines).
If a line begins with a hostname or IP address or the special word ‘default’, that line is considered to be the
beginning of a new set of filtering specifications. The filtering specifications will be applied to any packet
crossing the point-to-point link connecting this host to the peer named by that initial hostname or IP
address. The hostname or IP address in the first column of the filter file refers to the peer (system or
router or terminal server) at the remote end of the point-to-point (PPP or SLIP) link. The hostname or IP
address in the first column of the filter file, and associated with the link peer, is unrelated to the source or
destination IP address of any packet crossing the link. If the link peer’s address doesn’t match any name or
address specified in the first column of filter file, the filter specification following the special word ‘default’
will be used.
If a newline is followed by white space, that line is a continuation of the filtering specification already in
progress.
There are four keywords to describe the actions taken by
pppd in response to a particular packet:
bringup Describes those packets that will cause a call to be placed and a connection initiated.
Packets of this sort also must qualify to ‘pass’ across the link, either by being explicitly
mentioned or by inclusion in a larger class in the ‘pass’ section.
pass Describes those packets that will be allowed to traverse the link on an already-
established connection. Only packets which would be passed can cause the link to be
brought up. Any packet that is not passed is optionally logged, then discarded.
keepup Describes packets that will reset the idle timer, thereby keeping the line connected.
log Describes packets whose headers or contents are to be noted in the log file.
After each action keyword comes stanzas, separated by white space, describing packets that fit the criteria
for that action. Each stanza is processed in the order shown in the file, and contain restrictions or permis-
sions on the packets encountered. As soon as a pattern or a condition is found that matches the packet in
question, pppd takes the indicated action and ignores the rest of the listed stanzas (i.e. inclusive or with
shortcut evaluation).
Stanzas may contain IP protocol numbers, optionally hyphen-separated ranges of TCP or UDP port
numbers along with the
/tcp or /udp qualifier, numbers representing ICMP message types or codes
(which can be found in <netinet/ip_icmp.h>) along with the ‘/icmp’ qualifier, service names
corresponding to entries in /etc/services, or names or IP addresses of hosts or networks, or the spe-
cial keyword ‘all’, which is the default for all actions except ‘log’, where the default is ‘!all’. (Usually, it is
unnecessary to use ‘all’; as a convenience,
pppd automatically adds a ‘!all’ at the end of a stanza list if the
last stanza is not negated, and add an ‘all’ at the end of a stanza list if the last stanza is negated. For exam-
ple, in the typical case of ‘log’ this sensibly results in only those packets matching the stanzas shown being
logged, and no others. In the typical case of ‘pass’, this results in certain listed packets being restricted, but
allowing the passage of all others.)
If a network is specified, either by name or by address, then the corresponding network mask must also be
specified if it is of a different size than the default for that class of network. The network mask and addi-
tional ‘and’ conditions within a stanza are separated by slashes (‘/’), and may be specified either as a series
of decimal numbers separated by periods, or as a single 32-bit hexadecimal number. The sense of a stanza
may be negated by prefixing it with an exclamation mark (‘!’).
HP-UX 11i Version 1: September 2005 − 1 − Hewlett-Packard Company Section 4−−217