| 摘要 |
Small, optimized sequences of binary 5-tuples, representing filter rules, which achieve space efficient packet filtering. A post-match procedure table allows dynamic and extensible packet processing. Packet filtering is accomplished by processing filter rule statements and procedure statements, entered by a user in a rules file, to generate 5-tuple filtering rules and a procedure table, and loading the filtering rules and procedure table into the filter interpreter. A filter interpreter then applies the resolved filtering rules for each packet received at the network adapter. When a filtered packet matches a rule, a specified function is invoked.
|
