📄 filters.html
字号:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"><HTML><HEAD><TITLE>Filters</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.64"><LINKREL="HOME"TITLE="IPTraf User's Manual"HREF="manual.html"><LINKREL="PREVIOUS"TITLE="Additional Information"HREF="morelanmoninfo.html"><LINKREL="NEXT"TITLE="ARP, RARP, and other Non-IP Packet Filters"HREF="nonipfilters.html"></HEAD><BODYCLASS="CHAPTER"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#0000FF"VLINK="#840084"ALINK="#0000FF"><DIVCLASS="NAVHEADER"><TABLEWIDTH="100%"BORDER="0"CELLPADDING="0"CELLSPACING="0"><TR><THCOLSPAN="3"ALIGN="center">IPTraf User's Manual</TH></TR><TR><TDWIDTH="10%"ALIGN="left"VALIGN="bottom"><AHREF="morelanmoninfo.html"><<< Previous</A></TD><TDWIDTH="80%"ALIGN="center"VALIGN="bottom"></TD><TDWIDTH="10%"ALIGN="right"VALIGN="bottom"><AHREF="nonipfilters.html">Next >>></A></TD></TR></TABLE><HRALIGN="LEFT"WIDTH="100%"></DIV><DIVCLASS="CHAPTER"><H1><ANAME="FILTERS">Filters</A></H1><P> Filters are used to control the information displayed by all facilities. You may want to view statistics only on particular traffic so you must restrict the information displayed. The filters also apply to logging activity.</P><P> The IPTraf filter management system is accessible through the <ICLASS="EMPHASIS">Filters...</I> submenu.</P><DIVCLASS="FIGURE"><ANAME="AEN1295"></A><P><IMGSRC="iptraf-filtermenu.png"></P><P><B>Figure 1. The Filters submenu</B></P></DIV><DIVCLASS="SECT1"><H1CLASS="SECT1"><ANAME="IPFILTERS">IP Filters</A></H1><P> The <ICLASS="EMPHASIS">Filters/IP...</I> menu option allows you to define a set of rules that determine what IP traffic to pass to the monitors. Selecting this option pops up another menu with the tasks used to define and apply custom IP filters.</P><DIVCLASS="FIGURE"><ANAME="AEN1302"></A><P><IMGSRC="iptraf-ipfltmenu.png"></P><P><B>Figure 2. The IP filter menu</B></P></DIV><DIVCLASS="SECT2"><H2CLASS="SECT2"><ANAME="AEN1305">Defining a New Filter</A></H2><P> A freshly installed program will have no filters defined, so before anything else, you will have to define a filter. You can do this by selecting the <ICLASS="EMPHASIS">Define new filter...</I> option.</P><P> Selecting this option displays a box asking you to enter a short description of the filter you are going to define. Just enter any text that clearly identifies the nature of the filter.</P><DIVCLASS="FIGURE"><ANAME="AEN1310"></A><P><IMGSRC="iptraf-ipfltnamedlg.png"></P><P><B>Figure 3. The IP filter name dialog</B></P></DIV><P> Press Enter when you're done with that box. As an alternative, you can also press Ctrl+X to cancel the operation.</P><DIVCLASS="SECT3"><H3CLASS="SECT3"><ANAME="AEN1314">The Filter Rule Selection Screen</A></H3><P>After you enter the filter's description, you will be taken to a blankrule selection box. At this screen you manage the various rules youdefine for this filter. You can opt to insert, append, edit, or deleterules.</P><DIVCLASS="FIGURE"><ANAME="AEN1317"></A><P><IMGSRC="iptraf-ipfltlist.png"></P><P><B>Figure 4. The filter rule selection screen. Selecting an entrydisplays that set for editing</B></P></DIV><P>Any rules defined will appear here. You will see thesource and destinationaddresses, masks and ports (long addresses and masks maybe truncated) and whether this rule includes or excludes matchingpackets.</P><P>Between the source and destination parameters is an arrow thatindicates whether the rule matches packets (single-headed) only exactly or whetherit matches packets flowing in the opposite direction (double-headed).</P><P>At this screen, press I to insert at the current position of the selectionbar, A to append a rule to the end of the list, Enter toedit the highlighted rule and D to delete the selected rule. Withan empty list, A or I can be used to add the first rule.</P><P>To add the first rule, press A or I. You will then be presented witha dialog box that allows you to enter the rule's parameters.</P></DIV><DIVCLASS="SECT3"><H3CLASS="SECT3"><ANAME="AEN1324">Entering Filter Rules</A></H3><P> You can enter addresses of individual hosts, networks, or a catch-all address. The nature of the address will be determined by the wildcard mask.</P><P> You'll notice two sets of fields, marked <TTCLASS="COMPUTEROUTPUT">Source</TT> and <TTCLASS="COMPUTEROUTPUT">Destination</TT>. You fill these out with the information about your source and targets.</P><P> Fill out the host name or IP address of the hosts or networks in the first field marked <TTCLASS="COMPUTEROUTPUT">Host name/IP Address</TT>. Enter it in standard dotted-decimal notation. When done, press Tab to move to the <TTCLASS="COMPUTEROUTPUT">Wildcard mask</TT> field. The wildcard mask is similar but not exactly identical to the standard IP subnet mask. The wildcard mask is used to determine which bits to ignore when processing the filter. In most cases, it will work very closely like a subnet mask. Place ones (1) under the bits you want the filter to recognize, and keep zeros (0) under the bits you want the filter to ignore. For example:</P><P>To recognize the host 207.0.115.44</P><DIVCLASS="INFORMALTABLE"><ANAME="AEN1334"></A><P></P><TABLEBORDER="0"WIDTH="100%"BGCOLOR="#E0E0E0"CELLSPACING="0"CELLPADDING="4"CLASS="CALSTABLE"><TBODY><TR><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP">IP address</TD><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">207.0.115.44</TT></TD></TR><TR><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP">Wildcard mask</TD><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">255.255.255.255</TT></TD></TR></TBODY></TABLE><P></P></DIV><P>To recognize all hosts belonging to network202.47.132.<TTCLASS="REPLACEABLE"><I>x</I></TT></P><DIVCLASS="INFORMALTABLE"><ANAME="AEN1349"></A><P></P><TABLEBORDER="0"WIDTH="100%"BGCOLOR="#E0E0E0"CELLSPACING="0"CELLPADDING="4"CLASS="CALSTABLE"><TBODY><TR><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP">IP address</TD><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">202.47.132.0</TT></TD></TR><TR><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP">Wildcard mask</TD><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">255.255.255.0</TT></TD></TR></TBODY></TABLE><P></P></DIV><P>To recognize all hosts with any address:</P><DIVCLASS="INFORMALTABLE"><ANAME="AEN1363"></A><P></P><TABLEBORDER="0"WIDTH="100%"BGCOLOR="#E0E0E0"CELLSPACING="0"CELLPADDING="4"CLASS="CALSTABLE"><TBODY><TR><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP">IP address</TD><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">0.0.0.0</TT></TD></TR><TR><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP">Wildcard mask</TD><TDWIDTH="50%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">0.0.0.0</TT></TD></TR></TBODY></TABLE><P></P></DIV><P> The IP address/wildcard mask mechanism of the display filter doesn't recognize IP address class. It uses a simple bit- pattern matching algorithm.</P><P> The wildcard mask also does not have to end on a byte boundary; you may mask right into a byte itself. For example, 255.255.255.224 masks 27 bits (255 is 11111111, 224 is 11100000 in binary).</P><P> IPTraf also accepts host names in place of the IP addresses. IPTraf will resolve the host name when the filter is loaded. When the filter is interpreted, the wildcard mask will also be applied. This can be useful in cases where a single host name may resolve to several IP addresses.</P><DIVCLASS="TIP"><P></P><TABLECLASS="TIP"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="./stylesheet-images/tip.gif"HSPACE="5"ALT="Tip"></TD><THALIGN="LEFT"VALIGN="CENTER"><B>Tip</B></TH></TR><TR><TD> </TD><TDALIGN="LEFT"VALIGN="TOP"><P> See the <ICLASS="EMPHASIS">Linux Network Administrator's Guide</I> if you need more information on IP addresses and subnet masking.</P></TD></TR></TABLE></DIV><DIVCLASS="TIP"><P></P><TABLECLASS="TIP"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="./stylesheet-images/tip.gif"HSPACE="5"ALT="Tip"></TD><THALIGN="LEFT"VALIGN="CENTER"><B>Tip</B></TH></TR><TR><TD> </TD><TDALIGN="LEFT"VALIGN="TOP"><P>IPTraf allows you to specify the wildcard mask in Classless Interdomain Routing(CIDR) format. This format allows you to specify the number of 1-bits thatmask the address. CIDR notation is the form<ICLASS="EMPHASIS"><TTCLASS="COMPUTEROUTPUT">address/bits</TT></I> where the<ICLASS="EMPHASIS"><TTCLASS="COMPUTEROUTPUT">address</TT></I> is the IPaddress or host name and<ICLASS="EMPHASIS"><TTCLASS="COMPUTEROUTPUT">bits</TT></I> is the number of1-bits in the mask. For example, if you want to mask 10.1.1.0 with<TTCLASS="COMPUTEROUTPUT">255.255.255.0</TT>, note that<TTCLASS="COMPUTEROUTPUT">255.255.255.0</TT> has 24 1-bits, so insteadof specifying <TTCLASS="COMPUTEROUTPUT">255.255.255.0</TT> in the wildcardmask field, you can just enter <TTCLASS="COMPUTEROUTPUT">10.1.1.0/24</TT>in the address field. IPTraf will translate the mask bits into anappropriate wildcard mask and fill in the mask field the next time you editthe filter rule.</P><P>If you specify the mask in CIDR notation, leave the wildcard mask fieldsblank. If you fill them up, the wildcard mask fields will take precedence.</P></TD></TR></TABLE></DIV><P> The <TTCLASS="COMPUTEROUTPUT">Port</TT> fields should contain a port number or range of any TCP or UDP service you may be interested in. If you want to match only a single port number, fill in the first field, while leaving the second blank or set to zero. Fill in the second field if you want to match a range of ports (e.g. 80 to 90). Leave the first field blank or set to zero to let the filter ignore the ports altogether. You will most likely be interested in target ports rather than source ports (which are usually unpredictable anyway, perhaps with the exception of FTP data).</P><P>Non-TCP and non-UDP packets are not affected by these fields, and theseare used only when filtering TCP or UDP packets.</P><P> Fill out the second set of fields with the parameters of the opposite end of the connection.</P><DIVCLASS="TIP"><P></P><TABLECLASS="TIP"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="./stylesheet-images/tip.gif"HSPACE="5"ALT="Tip"></TD><THALIGN="LEFT"VALIGN="CENTER"><B>Tip</B></TH></TR><TR><TD> </TD><TDALIGN="LEFT"VALIGN="TOP"><P>Any address or mask fields left blank default to0.0.0.0 while blank<TTCLASS="COMPUTEROUTPUT">Port</TT> fields default to 0.This makes it easy to definefilter rules if you're interested only in either the source or destination,but not the other. For example, you may be interestedin traffic originating from network 61.9.88.0, in which case you just enterthe source address, mask and portin the<TTCLASS="COMPUTEROUTPUT">Source</TT> fields, while leaving the<TTCLASS="COMPUTEROUTPUT">Destination</TT> fields blank.</P></TD></TR></TABLE></DIV><P>The next fields let you specify which IP-type protocols you want matched bythis filter rule. Any packet whose protocol's corresponding fieldis marked with a <TTCLASS="COMPUTEROUTPUT">Y</TT> is matched against thefilter's defined IP addresses and ports, otherwisethey don't pass through this filter rule.</P><P>If you want to evaluate all IP packets just markwith <TTCLASS="COMPUTEROUTPUT">Y</TT> the <TTCLASS="COMPUTEROUTPUT">AllIP</TT> field.</P><P>For example, if you want to see only all TCP traffic, mark the<TTCLASS="COMPUTEROUTPUT">TCP</TT> fieldwith <TTCLASS="COMPUTEROUTPUT">Y</TT>.</P><P>The long field marked <TTCLASS="COMPUTEROUTPUT">Additionalprotocols</TT> allows you to specify other protocolsby their IANA number. (You can view the common IP protocol numberin the <TTCLASS="FILENAME">/etc/protocols</TT> file). You can specify a listof protocol numbers or ranges separated by commas,Ranges have the beginning and ending protocol numbers separated with ahyphen.</P><P>For example, to see the RSVP (46), IP mobile (55), and protocols(101 to 104), you use an entry that looks like this:</P><TABLEBORDER="0"BGCOLOR="#E0E0E0"WIDTH="100%"><TR><TD><PRECLASS="SYNOPSIS">46, 55, 101-104</PRE></TD></TR></TABLE><P>It's certainly possible to specify any of the protocols listed above inthis field. Entering <TTCLASS="COMPUTEROUTPUT">1-255</TT> isfunctionally identicalto marking <TTCLASS="COMPUTEROUTPUT">All IP</TT>with a <TTCLASS="COMPUTEROUTPUT">Y</TT>.</P><P> The next field is marked <TTCLASS="COMPUTEROUTPUT">Include/Exclude</TT>. This field allows you to decide whether to include or filter out matching packets. Setting this field to <TTCLASS="COMPUTEROUTPUT">I</TT> causes the filter to pass matching packets, while setting it to <TTCLASS="COMPUTEROUTPUT">E</TT> causes the filter to drop them. This field is set to <TTCLASS="COMPUTEROUTPUT">I</TT> by default.</P><P>The last field in the dialog is labeled <TTCLASS="COMPUTEROUTPUT">Match opposite</TT>. When setto <TTCLASS="COMPUTEROUTPUT">Y</TT>, the filter will match packets flowing in the opposite direction.Previous versions of IPTraf used to match TCP packets flowing in either direction, so the sourceand destination address/mask/port combinations were actually interchangeable. Starting withIPTraf 3.0, when filters extended to more than just the IP traffic monitor, this behavior is no longerthe default throughout IPTraf except in the IP traffic monitor's TCP window.</P><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="./stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><THALIGN="LEFT"VALIGN="CENTER"><B>Note</B></TH></TR><TR><TD> </TD><TDALIGN="LEFT"VALIGN="TOP"><P>For TCP packets, this field is used in all facilities except the IP traffic monitor. Becausethe IP traffic monitor must capture TCP packets in both directionsto properly determine a closed connection, the filter automatically matchespackets in the opposite direction, regardless of this field's setting. Howeveriin all other facilities, automatic matching of the reverse packets is not performedunless you set this field to <TTCLASS="COMPUTEROUTPUT">Y</TT>.</P><P>Filters for UDP and other IP protocols do not automatically match packets in the opposite directionunless you set the field to <TTCLASS="COMPUTEROUTPUT">Y</TT>, even in the IP traffic monitor.</P></TD></TR></TABLE></DIV><P> Press Enter to accept all parameters when done. The parameters will be accepted and you'll be taken back to the rule selection box. You canthen add more rules by pressing A or you can insert new rules at any pointby pressing I. Should you make a mistake, you can press Enter toedit the selected filter. You may enter as many sets of parameters as you wish. Press Ctrl+X when done.</P><DIVCLASS="NOTE"><P></P><TABLECLASS="NOTE"WIDTH="100%"BORDER="0"><TR><TDWIDTH="25"ALIGN="CENTER"VALIGN="TOP"><IMGSRC="./stylesheet-images/note.gif"HSPACE="5"ALT="Note"></TD><THALIGN="LEFT"VALIGN="CENTER"><B>Note</B></TH></TR><TR><TD> </TD><TDALIGN="LEFT"VALIGN="TOP"><P>Because of the major changes in the filtering system since IPTraf 2.7,old filters will no longer work and will have to be redefined.</P></TD></TR></TABLE></DIV><DIVCLASS="FIGURE"><ANAME="AEN1442"></A><P><IMGSRC="iptraf-ipfltdlg.png"></P><P><B>Figure 5. The IP filter parameters dialog</B></P></DIV></DIV><DIVCLASS="SECT3"><H3CLASS="SECT3"><ANAME="AEN1445">Examples</A></H3><P>To see all traffic to/from host 202.47.132.1 from/to 207.0.115.44, regardless of TCP port</P><DIVCLASS="INFORMALTABLE"><ANAME="AEN1448"></A><P></P><TABLEBORDER="0"WIDTH="100%"BGCOLOR="#E0E0E0"CELLSPACING="0"CELLPADDING="4"CLASS="CALSTABLE"><TBODY><TR><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP">Host name/IP Address</TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">202.47.132.2</TT></TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">207.0.115.44</TT></TD></TR><TR><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP">Wildcard mask</TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">255.255.255.255</TT></TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">255.255.255.255</TT></TD></TR><TR><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP">Port</TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">0</TT></TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">0</TT></TD></TR><TR><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP">Protocols</TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">TCP: Y</TT></TD><TD> </TD></TR><TR><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP">Include/Exclude</TD><TDWIDTH="33%"ALIGN="LEFT"VALIGN="TOP"><TTCLASS="COMPUTEROUTPUT">I</TT⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -