Re: Filter MAC Destination

[Shao Miller <Shao.Miller@yrdsb.edu.on.ca>]

On 6/18/2012 11:51, Jan Engelhardt wrote:
> On Monday 2012-06-18 17:34, Shao Miller wrote:
>> On 5/31/2012 13:19, Jan Engelhardt wrote:
>>> On Thursday 2012-05-31 19:14, Miller, Shao wrote:
>>>> I would like to filter Spanning-Tree Protocol data units, which 
>>>> have a common destination MAC address. Is filtering based on a 
>>>> destination MAC address possible, or only based on a source MAC 
>>>> address? 
>>> It is indeed possible to check for source and/or destination MAC 
>>> address for STP packets. 
>> Thanks a lot, Jan. My guess is that a certain vendor is using 
>> netfilter "underneath", so I was trying to figure out why their 
>> firewalls had the ability to filter based on source MAC, but not 
>> destination. So I've no idea. 
> They probably have a lame web interface that just does not show the 
> destination field. It certainly is possible with the ebtables command 
> line tool. 

Actually, their user interfaces (one web, one CLI) are pretty extensive, 
and quite good at hiding the Linux behind.  In this instance, it can't 
be done through either interface, and it's not mentioned in the user 
guide, and a support case yielded that it wasn't possible.

However, I figure that if they use their magic CLI command (and magic 
"engineer" password that it requires) to get a bash (or something) shell 
prompt, then they probably could issue an 'ebtables' command, just as 
you mention. *sigh*

Thanks again.

- Shao Miller