Справочник Пользователя для Netopia 4753 2a4na

When a packet is compared (in most cases) a logical AND function is per formed. First the IP addresses and 
subnet masks are conver ted to binar y and then combined with AND. The rules for the logical use of AND are as 
follows:

0 AND 0 = 0

0 AND 1 = 0

1 AND 0 = 0

1 AND 1 = 1

For example:

Filter rule:

Deny

IP: 163.176.1.15BINARY:

10100011.10110000.00000001.00001111

Mask: 255.255.255.255BINARY:11111111.11111111.11111111.11111111

Incoming Packet:

IP 163.176.1.15BINARY:

10100011.10110000.00000001.00001111

If you put the incoming packet and subnet mask together with AND, the result is:

10100011.10110000.00000001.00001111

which matches the IP address in the filter rule and the packet is denied.

With a given set of filter rules, there is an Implied rule that may or may not be shown to the user. The implied 
rule tells the filter set what to do with a packet that does not match any of the filter rules. An example of implied 
rules is as follows:

The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP, not 
UDP. The ACK bit is par t of the TCP mechanism that guarantees the deliver y of data. The ACK bit is set 
whenever one side of a connection has received data from the other side. Only the first TCP packet will not have 
the ACK bit set; once the TCP connection is in place, the remainder of the TCP packets with have the ACK bit 
set.

The ACK bit is helpful for firewall design and reduces the number of potential filter rules. A filter rule could be 
created just allowing incoming TCP packets with the ACK bit set, since these packets had to be originated from 
the local network. 

Implied

Meaning

Y+Y+Y=N

If all filter rules are YES, the implied rule is NO.

N+N+N=Y

If all filter rules are NO, the implied rule is YES.

Y+N+Y=N

If a mix of YES and NO filters, the implied rule is NO.