Forum Discussion
chuck_16066
Nimbostratus
NimbostratusPacket filter and port range
I need to do packet filter rules with a dynamic port range like 1024 - 65535. However, the packet filter rule does not take the TCPDUMP format of:
( dst portrange 1024-65535 )
...
hoolio
Cirrostratus
CirrostratusHi Chuck,
I'm not sure why the packet filters don't support the portrange keyword. I saw the same error on 10.0.1. 'b packet filter help' on a 10.0.1 unit shows:
The BIG-IP system packet filters are based on the Berkeley Software Design Packet Filter (BPF) architecture.
Maybe BPF doesn't support portrange? If you don't find a solution for using packet filters and the traffic you want to restrict to a port range is passing through a VIP, you could use an iRule to restrict access using [TCP::local_port] > 1024 && [TCP::local_port] < 65535.
Aaron
