Motorola Enterprise Series Routers 사용자 설명서

다운로드
페이지 340
Security   10-41
Established connections
The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP, not 
UDP. The ACK bit is par t of the TCP mechanism that guarantees the deliver y of data. The ACK bit is set 
whenever one side of a connection has received data from the other side. Only the first TCP packet will not have 
the ACK bit set; once the TCP connection is in place, the remainder of the TCP packets with have the ACK bit 
set.
The ACK bit is helpful for firewall design and reduces the number of potential filter rules. A filter rule could be 
created just allowing incoming TCP packets with the ACK bit set, since these packets had to be originated from 
the local network. 
Example filter set screen
This is an example of the Motorola Netopia
®
 filter set screen:
Filter basics
In the source or destination IP address fields, the IP address that is entered must be the network address of 
the subnet. A host address can be entered, but the applied subnet mask must be 32 bits (255.255.255.255).
The Motorola Netopia® Embedded Software Version 8.7.4 has the ability to compare source and destination 
TCP or UDP por ts. These options are as follows:
Item
What it means
No Compare
Does not compare TCP or UDP por t
Not Equal To
Matches any por t other than what is defined
Less Than
Anything less than the por t defined
                            Change Input Filter 1
         Enabled:                           Yes
         Forward:                           No
         Source IP Address:                 0.0.0.0
         Source IP Address Mask:            0.0.0.0
         Dest. IP Address:                  0.0.0.0
         Dest. IP Address Mask:             0.0.0.0
         Protocol Type:                     TCP
         Source Port Compare...             No Compare
         Source Port ID:                    0
         Dest. Port Compare...              Equal
         Dest. Port ID:                     2000
         Established TCP Conns. Only:       No