D-Link xStack DES-3528 Series - Page 361

xStack® DES-3528/DES-3552 Series Layer 2 Managed Stackable Fast Ethernet Switch Web UI Reference Guide
354
2. The switch will deny all other ARP packets which claim they are from the gateway’s IP.
The design of Packet Content ACL on the Switch enables users to inspect any offset chunk. An offset chunk is a 4-
byte block in a HEX format, which is utilized to match the individual field in an Ethernet frame. Each profile is
allowed to contain up to a maximum of four offset chunks. Furthermore, only one single profile of Packet Content
ACL can be supported per switch. In other words, up to 16 bytes of total offset chunks can be applied to each
profile and a switch. Therefore, a careful consideration is needed for planning and configuration of the valuable
offset chunks.
In Table 6, you will notice that the Offset_Chunk0 starts from the 127th byte and ends at the 128th byte. It also can
be found that the offset chunk is scratched from 1 but not zero.
Offset
Chunk
Offset
Chunk0
Offset
Chunk1
Offset
Chunk2
Offset
Chunk3
Offset
Chunk4
Offset
Chunk5
Offset
Chunk6
Offset
Chunk7
Offset
Chunk8
Offset
Chunk9
Offset
Chunk10
Offset
Chunk11
Offset
Chunk12
Offset
Chunk13
Offset
Chunk14
Offset
Chunk15
Byte
127 3 7 11 15 19 23 27 31 35 39 43 47 51 55 59
Byte
128 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60
Byte
1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61
Byte
2 6 10 14 18 22 26 30 34 38 42 46 50 54 58 62
Offset
Chunk
Offset
Chunk16
Offset
Chunk17
Offset
Chunk18
Offset
Chunk19
Offset
Chunk20
Offset
Chunk21
Offset
Chunk22
Offset
Chunk23
Offset
Chunk24
Offset
Chunk25
Offset
Chunk26
Offset
Chunk27
Offset
Chunk28
Offset
Chunk29
Offset
Chunk30
Offset
Chunk31
Byte
63 67 71 75 79 83 87 91 95 99 103 107 111 115 119 123
Byte
64 68 72 76 80 84 88 92 96 100 104 108 112 116 120 124
Byte
65 69 73 77 81 85 89 93 97 101 105 109 113 117 121 125
Byte
66 70 74 78 82 86 90 94 98 102 106 110 114 118 122 126
Table 6. Chunk and Packet Offset
The following table indicates a completed ARP packet contained in Ethernet frame which is the pattern for the
calculation of packet offset.
Table 5 A Completed ARP Packet Contained in an Ethernet Frame
Command Description
Step 1:
create access_profile profile_id 1
profile_name 1 ethernet source_mac FF-
FF-FF-FF-FF-FF ethernet_type
Create access profile 1 to match Ethernet Type and
Source MAC address.
Step 2:
config access_profile profile_id 1 add
access_id 1 ethernet source_mac 01-02-
03-04-05-06 ethernet_type 0x806 port 1-
12 permit
Configure access profile 1
Only if the gateway’s ARP packet that contains the
correct Source MAC in the Ethernet frame can pass
through the switch.
Step 3:
create access_profile profile_id 2
profile_name 2 packet_content_mask
Create access profile 2