Tsunami MP.11 Installation and Management Model 5012-SUR ...

Configuration Tsunami MP.11 5012-SUR Installation and Management
Filtering
Filtering
Overview
Click Configure > Filtering to configure packet filtering. Packet filtering can be used to control and optimize network
performance.
The Filtering feature can selectively filter specific packets based upon their Ethernet protocol type. Protocol filtering is
done at the Bridge layer.
Protocol filters are useful for preventing bridging of selected protocol traffic from one segment of a network to other
segments (or subnets). You can use this feature both to increase the amount of bandwidth available on your network and
to increase network security.
Increasing Available Bandwidth
It may be unnecessary to bridge traffic from a subnet using IPX/SPX or AppleTalk to a segment of the network with UNIX
workstations. By denying the IPX/SPX AppleTalk traffic from being bridged to the UNIX subnet, the UNIX subnet is free of
this unnecessary traffic.
Increasing Network Security
By bridging IP and IP/ARP traffic and blocking LAN protocols used by Windows, Novell, and Macintosh servers, you can
protect servers and client systems on the private local LAN from outside attacks that use those LAN protocols. This type
of filtering also prevents private LAN data from being bridged to an untrusted remote network or the Internet.
To prevent blocking your own access (administrator) to the unit, Proxim recommends that IP (0x800) and ARP (0x806)
protocols are always passed through.
Sample Use and Validation
Configure the protocol filter to let only IP and ARP traffic pass through the 5012-SUR (bridge) from one network segment
to another. Then, attempt to use Windows file sharing across the bridge. The file should not allow sharing; the packets
are discarded by the bridge.
Setting the ARP Filter
There may be times when you need to set the ARP or Multicast. Usually, this is required when there are many nodes on
the wired network that are sending ARP broadcast messages or multicast packets that unnecessarily consume the
wireless bandwidth. The goal of these filters is to allow only necessary ARP and multicast traffic through the 1.6 Mbps
wireless pipe.
The TCP/IP Internet Protocol Suite uses a method known as ARP (Address Resolution Protocol) to match a device's
MAC (Media Access Control) address with its assigned IP address. The MAC address is a unique 48-bit identifier
assigned to each hardware device at the factory by the manufacturer. The MAC address is commonly represented as 6
pairs of hexadecimal digits separated by colons. For example, a RangeLAN2 device may have the MAC address of
00:20:A6:33:ED:45.
When devices send data over the network (Ethernet, Token Ring, or wireless), they use the MAC address to identify a
packet's source and destination. Therefore, an IP address must be mapped to a MAC address in order for a device to
send a packet to particular IP address. In order to resolve a remote node's IP address with its MAC address, a device
sends out a broadcast packet to all nodes on the network. This packet is known as an ARP request or ARP broadcast
and requests that the device assigned a particular IP address respond to the sender with its MAC address.
Because ARP requests are broadcast packets, these packets are forwarded to wireless nodes by default, even if the
packet is not meant for a wireless node. As the number of nodes on a network backbone increases, so does the number
of ARP broadcasts that are forwarded to the wireless nodes. Many of these ARP broadcasts are unnecessary and can
84