C
HAPTER
23
| ACL Commands
– 327 –
ARP/RARP opcode set to ARP, rarp - frame must have ARP/
RARP opcode set to RARP, other - frame has unknown ARP/
RARP opcode flag; Default: any)
arp-flags - One of the following ARP flags:
request - Frame must have ARP Request or RARP Request
opcode flag set.
smac - ARP frame where sender hardware address (SHA)
field is equal to the SMAC address.
tmac - RARP frames where target hardware address (THA)
is equal to the SMAC address.
len - ARP/RARP frames where the hardware address length
(HLN) is equal to Ethernet (0x06) and the protocol address
length (PLN) is equal to IPv4 (0x04).
ip - ARP/RARP frames where the hardware address space
(HRD) is equal to Ethernet (1).
ether [0 | 1 | any] - Frames can be matched according to
their ARP/RARP protocol address space (PRO) settings
(Options: 0 - ARP/RARP frames where the PRO is equal to IP
(0x800) must not match this entry, 1 - ARP/RARP frames
where the PRO is equal to IP (0x800), any - any value is
allowed; Default: any)
ip - One of the following IP parameters:
sip - Source IP address (a.b.c.d/n) or any.
dip - Destination IP address (a.b.c.d/n) or any.
protocol - IP protocol number (0-255) or any.
ip-flags - One of the following IP flags:
ttl - Time-to-Live flag with any value.
options - Options flag with any value.
fragment [0 | 1 | any] - Specifies the fragment offset
settings for this rule. This involves the settings for the More
Fragments (MF) bit and the Fragment Offset (FRAG OFFSET)
field for an IPv4 frame. (Options: 0 - IPv4 frames where the
MF bit is set or the FRAG OFFSET field is greater than zero
must not match this entry, 1 - IPv4 frames where the MF bit
is set or the FRAG OFFSET field is greater than zero must
match this entry, any - any value is allowed; Default: any)
icmp - One of the following ICMP parameters:
sip - Source IP address (a.b.c.d/n) or any.
dip - Destination IP address (a.b.c.d/n) or any.
icmp-type - ICMP type number (0-255) or any.
icmp-code - ICMP code number (0-255) or any.
ip-flags - One of the IP flags listed under the ip parameter.
To Next Page
Loading...
