### set filter

Use the set filter command to manage filters that control and record traffic over PPP, SLIP, and CSLIP connections. With the set filter command, you can:

- Create filters

- Remove filters from the filters table

- Display entries in the filter table

- Display the contents of a filter

The filter table holds a maximum of 64 entries.

Root privileges are required to use the set filter command.

See the set user command for information on associating a filter with a particular user.

#### About Filters

Use filters to trigger the following actions on PPP, SLIP, and CSLIP connections:

- Block or pass packets

- Bring up or reject connections

- Reset the idle timeout timer

- Send information to the log file

#### Rules for Creating Filters

- The action a filter takes depends on the contents of the filter and on the type of filter it is defined as on the set user command. If the filter is referenced on the

  - passpacket field, it will allow packets that meet filter criteria to pass through a serial port and block all others
  - bringup field, it will bring up a connection when the port handles a packet that meets filter criteria
  - keepup field, it will reset the timer defined on the set user idletimeout field when the port handles a packet that meets filter criteria
  - logpacket field, it will send a message to the log file when the port handles a packet that meets filter criteria

- Filters are made up of 1 to 32 stanzas, each of which expresses filtering criteria.

- Filter criteria are called tokens. Examples of tokens include IP addresses, TCP or UDP port numbers, whether a packet is incoming or outgoing, and several others.

- Tokens must be separated by slashes (/).

- Stanzas are processed in order. That is, first S1 (stanza 1) is processed and then S2, and so on.

- As soon as a stanza’s criteria is completely satisfied, filtering action occurs and subsequent stanzas are ignored. For example, if S1 specifies an IP address of 190.159.146.10 and an ICMP message type 7, a packet from that IP address carrying that ICMP message type will trigger filtering action. Subsequent stanzas will not be processed. Consequently, you must specify and relationships (all criteria must be satisfied) in the same stanza and or relationships (any of the criterion must be satisfied) in different stanzas.

- The exclamation mark (!) at the beginning of a stanza changes how the filter acts. When a packet is encountered that meets stanza criteria, the filter does not execute the filter function (for example, bringing up a connection) and it does not process any more stanzas.

#### Command Syntax

##### Creation Syntax

Enter the set filter command as shown below to create filters and add stanzas to them or to rename filters.

> `set filter name=name [newname=name] [s#=token\token\token...]`

##### Removal Syntax

Enter the set filter command as shown below to remove a filter from the filters table.

> `set filter {rmfilter=on range=range|rmfilter=name}`

##### Display Filter Table Entries

Enter the set filter command as shown below to display entries in the filter table.

> `set filter [range=range]`

##### Display Filter Stanzas

Enter the set filter command as shown below to display all the stanzas of a filter.

> `set filter name=name show=on`

#### Command Fields

Command Field | Description
name | Specifies a name for the filter.
newname | Specifies a new name for a previously defined filter.
range | Specifies an entry or range of entries in the filters table.
rmfilter | on - means that identified filters will be removed from the filter table. name - means that the filter identified by this name will be removed from the filter table.
show | on - means that stanzas from the filter identified on the name field will be displayed. off - means that stanzas from the filter identified on the name field will not be displayed. The default is off.
s#=token/token/token... | # - is the number of a stanza, which can be from 1 to 32. token/token/token... - are 1-32 tokens, which are the criteria by which filtering is accomplished. Separate tokens by a forward slash (/). Tokens can consist of any of the following: servicename, which means filter criterion is a name in the service table that identifies a particular process, such as telnet (see set service) hostname, which means filter criterion is the name of a host defined in the host table (see set host) protocol_number, which means filter criterion is the number in an IP packet that identifies the protocol to which IP should pass the packet. Use one of the following: 1 for ICMP, 2 for IGMP, 6 for TCP, and 17 for UDP. ip_addr, which means filter criterion is an IP address ip_mask, which is an IP mask that modifies the meaning of the ip_addr field port_num, which means filter criterion is a TCP or UDP port number port_num-port_num, which means filter criterion is a range of TCP or UDP port numbers rcv, which means filter criterion is incoming packets send, which means filter criterion is outgoing packets dst, which means filter criteria will be found in destination IP packet fields within the IP packet, such as destination IP addresses, ports, and host names src, which means filter criteria will be found in source IP packet fields, such as IP addresses, ports, or host names syn, which means start filtering when the start of a TCP data stream is encountered. This option is always used with the fin option and is used to trigger logging (logpacket field on the set user command). fin, which means stop filtering when the end of a TCP data stream is encountered. This value is always used with the syn option and ends logging (logpacket field on the set user command.). tcp, which means filter criterion is TCP packets udp, which means filter criterion is UDP packets icmp, which means filter criterion is ICMP packets. Note: You can also specify a type of ICMP packet. Here is how: s1= type/icmp. type is the type of ICMP packet, which can be any of the following: Message Type and Type Identifier Value: Echo reply - 0 Destination unreachable - 3 Source quench - 4 Redirect - 5 Echo request - 8 Time exceeded for a datagram - 11 Parameter problem on a datagram - 12 Timestamp request - 13 Timestamp reply - 14 Address mask request - 17 Address mask reply - 18 ! (exclamation), which means that when a packet is encountered that meets stanza criteria, the filter does not execute the filter function (for example, bringing up a connection) and it does not process any more stanzas

#### Command Examples

##### Displaying the Filter Table

In this example, the set filter command displays the filter table.

> `set filter`

##### Displaying Filter Stanzas

In this example, the set filter command displays stanzas of a filter.

> `set filter name=filter1 show=on`

##### Removing a Filter from the Filter Table

In this example, the set filter command removes a filter from the filter table.

> `set filter rmfilter=filter1`

##### Filtering on a Source IP Address

In this example, the set filter command creates a filter that uses a source IP address as the filter criterion.

> `set filter name=filter1 s1=src/199.86.8.3`

##### Filtering on an ICMP Packet Type

In this example the set filter command creates a filter that uses an ICMP type 13 packet (destination unreachable) as filter criterion.

> `set filter name=filter1 s1=13/icmp`