filter.cfg

来自「netflow,抓包」· CFG 代码 · 共 154 行

filter-definition default
  match start-time test-time

filter-primitive test-time
  type time
  permit ge 22:16:00

filter-primitive test-as
  type as
  permit 600,159

filter-primitive test-prefix-len
  type ip-address-prefix-len
  permit 32

filter-primitive test-protocol
  type ip-protocol
  permit tcp

filter-primitive UDP
  type ip-protocol
  permit UDP

filter-primitive TCP
  type ip-protocol
  permit TCP

filter-primitive test-tos
  type ip-tos
  mask 0xA0
  permit 0xE0

filter-primitive test-tcp-flags
  type ip-tcp-flags
  mask 0x2 
  permit 0x2   

filter-primitive test-ifindex
  type ifindex
  permit 0,5,10

filter-primitive test-engine
  type engine
  permit 0 

filter-primitive test-port
  type ip-port
  permit https 
  permit 80
  default deny

filter-primitive test-port2
  type ip-port
  permit pop3
  default deny

filter-primitive test-address
  type ip-address
  permit 0.0.0.1
  permit 0.0.0.2
  default deny

filter-primitive test-address-mask
  type ip-address-mask
  permit 0.0.0.0 255.255.255.0
  permit 128.146.197.1 255.255.255.255
  permit 128.146.197.2 255.255.255.255

filter-primitive test-prefix
  type ip-address-prefix
  permit 128.146.0.0/16
  permit 129.146.0.0/16
  permit 131.146.0.0/16
  permit 132.146.0.0/16
  permit 133.146.0.0/16
  permit 134.146.0.0/16
  default deny

filter-primitive test-prefix2
  type ip-address-prefix
  permit 128.146.0.0/16
  permit 129.146.0.0/16
  permit 131.146.0.0/16
  permit 132.146.0.0/16
  permit 133.146.0.0/16
  permit 134.146.0.0/16
  default deny

filter-primitive test-tag
  type tag
  permit 0x00
  permit 0x01
  permit 0xFF

filter-primitive test-tag-mask
  type tag-mask
  permit OSU 0xFF
  permit 0xFF 0xFF
  default deny  

filter-primitive test-counter
  type counter
  permit lt 5
#  permit gt 10
  default deny
  
filter-primitive test-time-date
  type time-date
  permit gt December 12, 2002 5:13:21
  
filter-primitive port80
  type ip-port
  permit 80

filter-primitive port25
  type ip-port
  permit smtp

filter-primitive dec12
  type time-date
  permit gt Sep 12, 2001


filter-definition t1
  match src-as test-as
  match dst-as test-as
  match src-ip-addr test-address
  match dst-ip-addr test-address-mask
  match exporter-ip-addr test-prefix
  match nexthop-ip-addr test-address
  match shortcut-ip-addr test-address
  match ip-protocol test-protocol
  match src-ip-addr-prefix-len test-prefix-len
  match ip-tos test-tos
  match ip-marked-tos test-tos
  match ip-tcp-flags test-tcp-flags
  match src-ip-port test-port
  match dst-ip-port test-port
  match src-ifindex test-ifindex
  match dst-ifindex test-ifindex
  match start-time test-time
  match end-time test-time
  match flows test-counter
  match octets test-counter
  match packets test-counter
  match duration test-counter
  or
  match engine-id test-engine
  match engine-type test-engine
  match src-tag test-tag
  match dst-tag test-tag-mask