Ref: 99980114
Title: Customer Filters For IB's
Date: 11/28/88

Copyright 3Com Corporation, 1991.  All rights reserved.

IB/1 and IB/2:  Filter <filter#> [+|-] = [<offset>:<mask>][,...]

IB/3:  Filter <filter#> [+|-] = [<offset>:[!|&|\]<mask>][,...]
        where: ! = NOT, & = AND, \ = OR
        (AND and OR are bit operations)

       Examples of logical operations:

            11011001                   11011001
      AND   10011101               OR  10011101
            --------                   --------
            10011001                   11011101

       the NOT operation filters all packets not matching
       the mask at the specified offset.

There are some guidelines for creating filters; make sure that
the filter is specific enough to not inadvertently filter
desirable packets.  This may require that the filter be multi-
part, for example:

                %1E:%0464,%0:%FFFF,%C:%0600

This filter filters XNS packets (%0600 at offset %C) which are
also Broadcast (%FFFF at offset %0) and destined for socket %464
(%0464 at offset %1E).  These packets are 3Com Nameserver
requests.  This filter was used to allow two Nameservers, one on
each side of an IB, and to make certain that requests for
Nameservice would be answered by the local Nameserver only.

Also, note:  For efficiency, the mask and offset which occurs
least often should be stated first.  In the example above, the
socket for Nameservice occurs less often than Broadcasts, which
occur less often than XNS packets.  If the first condition is not
met, the IB does not have to examine the packet for the
conditions which follow.

Another example:

          %1E:%4B

This filters all packets having the value %4B at offset %1E.  In
XNS, this is the socket for Bridge's XNS Remote Protocol.  On an
XNS only network, this would be sufficient; however, on a mixed
network running XNS and TCP/IP, this could filter certain IP
source addresses.  Therefore, you would want to add a qualifier
for XNS packets.  The filter would then be:

          %1E:%4B,%C:%0600

In the future, we may have "positive" as well as "negative"
filters.  Presently, we filter a packet if it matches the filter
specification.  "Positive" filters would filter packets which did
not meet the filter specification.

