Discussion

Table 9-5. Header match conditions used in firewall filters (continued)
Match term
source-prefix-list
prefix-list
prefix-list prefix-list
Port matches
destination-port number
destination-port name
source-port number
source-port name
Protocol and packet matches
icmp-type number
icmp-type name
Match description
IP source address of one of the prefixes in the prefix list.
IP source or destination address of one of the prefixes in the prefix list.
TCP or UDP destination port field, specified as a number or name. Use with the
protocol match condition to determine the protocol being used on a port.
Port names and numbers: afs, bgp, biff (512), bootpc (68), bootps (67), cmd (514),
cvspserver (2401), dhcp (67), domain (53), eklogin (2105), ekshell (2106), exec (512),
finger (79), ftp (21), ftp-data (20), http (80), https (443), ident, imap, kerberos-sec (88),
klogin (543), kpasswd (761), krb-prop (754), krbupdate (760), kshell (544), ldap (389),
login (513), mobileip-agent (434), mobilip-mn (435), msdp (639), netbios-dgm,
netbios-ns, netbios-ssn, nfsd (2049), nntp, ntalk (518), ntp pop3, pptp, printer (515),
radacct, radius, rip (520), rkinit (2108), smtp (25), snmp, snmptrap, snpp (444), socks,
ssh (22), sunrpc, syslog (514), tacacs-ds (65), talk (517), telnet(23), tftp (69), timed
(525), who (513), xdmcp, zephyr-clt (2103), zephyr-hm (2104)
TCP or UDP source port field, specified as a number or name. Use with the protocol
match condition to determine the protocol being used on a port.
Port names and numbers same as those listed for destination-port.
ICMP packet type field, specified as a number or name. Use with the protocol match
condition to determine the protocol being used on a port.
Type names and numbers: echo-reply (0), echo-request (8), info-reply, info-request,
mask-request, mask-reply, parameter-problem, redirect (5), router-advertisement (9),
router-solicit, source-quench (4), time-exceeded, timestamp, timestamp-reply,
unreachable (3)
packet-length bytes Length of the IP portion of the packet, including the header but excluding Layer 2
encapsulation overhead.
protocol number
protocol name
Packet field matches
fragment-flags number
fragment-offset number
ip-options number
IP protocol field, specified as a number or name.
Names and numbers: ah, egp (8), esp (50), gre (47), icmp, igmp (2), ipip (4), ipv6 (41),
ospf (89), pim, rsvp (46), tcp (6), udp
IP fragmentation flag field, specified as a number or name.
Flag names and numbers: dont-fragment (0x4000), more-fragments (0x2000),
reserved (0x8000)
Fragment offset from the beginning of the original packet, in 8-byte units. Use to identify
all fragmented packets. The More Fragments (MF) flag is set for all fragmented packets
except the last. To identify fragments, set fragment offset != 0 (or morefragments=1).
IP option field, specified as a number or name.
Option names and numbers: loose-source-route, record-route (7), router-alert,
strict-source-route, timestamp (68)
Creating a Simple Firewall Filter that Matches Packet Contents | 305
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.