RE: Filter MAC Destination

RE: Filter MAC Destination

[Miller, Shao]

Good day to all.

I would like to filter Spanning-Tree Protocol data units, which have a common destination MAC address.  Is filtering based on a destination MAC address possible, or only based on a source MAC address?

Thank you for your time.

- Shao Miller

RE: Filter MAC Destination

[Jan Engelhardt]

On Thursday 2012-05-31 19:14, Miller, Shao wrote:

>Good day to all.
>
>I would like to filter Spanning-Tree Protocol data units, which have a 
>common destination MAC address.  Is filtering based on a destination 
>MAC address possible, or only based on a source MAC address?

It is indeed possible to check for source and/or destination MAC 
address for STP packets.

Re: Filter MAC Destination

[Shao Miller]

On 5/31/2012 13:19, Jan Engelhardt wrote:
> On Thursday 2012-05-31 19:14, Miller, Shao wrote:
>> I would like to filter Spanning-Tree Protocol data units, which have 
>> a common destination MAC address.  Is filtering based on a 
>> destination MAC address possible, or only based on a source MAC address? 
> It is indeed possible to check for source and/or destination MAC 
> address for STP packets. 

Thanks a lot, Jan.  My guess is that a certain vendor is using netfilter 
"underneath", so I was trying to figure out why their firewalls had the 
ability to filter based on source MAC, but not destination.  So I've no 
idea.

Have a pleasant day.

- Shao Miller

Re: Filter MAC Destination

[Jan Engelhardt]

On Monday 2012-06-18 17:34, Shao Miller wrote:

> On 5/31/2012 13:19, Jan Engelhardt wrote:
>> On Thursday 2012-05-31 19:14, Miller, Shao wrote:
>>> I would like to filter Spanning-Tree Protocol data units, which have a common
>>> destination MAC address.  Is filtering based on a destination MAC address
>>> possible, or only based on a source MAC address? 
>> It is indeed possible to check for source and/or destination MAC address for
>> STP packets. 
>
> Thanks a lot, Jan.  My guess is that a certain vendor is using netfilter
> "underneath", so I was trying to figure out why their firewalls had the ability
> to filter based on source MAC, but not destination.  So I've no idea.

They probably have a lame web interface that just does not show the 
destination field. It certainly is possible with the ebtables command 
line tool.

Re: Filter MAC Destination

[Shao Miller]

On 6/18/2012 11:51, Jan Engelhardt wrote:
> On Monday 2012-06-18 17:34, Shao Miller wrote:
>> On 5/31/2012 13:19, Jan Engelhardt wrote:
>>> On Thursday 2012-05-31 19:14, Miller, Shao wrote:
>>>> I would like to filter Spanning-Tree Protocol data units, which 
>>>> have a common destination MAC address. Is filtering based on a 
>>>> destination MAC address possible, or only based on a source MAC 
>>>> address? 
>>> It is indeed possible to check for source and/or destination MAC 
>>> address for STP packets. 
>> Thanks a lot, Jan. My guess is that a certain vendor is using 
>> netfilter "underneath", so I was trying to figure out why their 
>> firewalls had the ability to filter based on source MAC, but not 
>> destination. So I've no idea. 
> They probably have a lame web interface that just does not show the 
> destination field. It certainly is possible with the ebtables command 
> line tool. 

Actually, their user interfaces (one web, one CLI) are pretty extensive, 
and quite good at hiding the Linux behind.  In this instance, it can't 
be done through either interface, and it's not mentioned in the user 
guide, and a support case yielded that it wasn't possible.

However, I figure that if they use their magic CLI command (and magic 
"engineer" password that it requires) to get a bash (or something) shell 
prompt, then they probably could issue an 'ebtables' command, just as 
you mention. *sigh*

Thanks again.

- Shao Miller