Pattern matching filter rules
Pattern matching is the use of an IPsec filter rule for filtering networking packets. A filter pattern can be a text string, a hexadecimal string, or a file containing more than one pattern. After a pattern filter rule is established and that pattern is detected in the body of any network packet, then the predefined action of the filter rule will result.
Pattern matching filter rules only apply to inbound network packets. Use the genfilt command to add a filter rule to the filter rule table. The filter rules generated by this command are called manual filter rules. Use the mkfilt command to activate or deactivate the filter rules. The mkfilt command can also be used to control the filter logging function.
A pattern file can contain a list, one per line, of text patterns or hexadecimal patterns. Pattern matching filter rules can be used to guard against viruses, buffer overflows, and other network security attacks.
Pattern matching filter rules can have a negative impact on system performance if they are used too broadly, and with a high number of patterns. It is best to keep the scope of their application as narrow as possible. For example, if a known virus pattern applies to sendmail, then specify the sendmail SMTP destination port 25 in the filter rule. This allows all other traffic to pass without incurring a performance impact from pattern matching.
The genfilt command recognizes and understands the pattern format used in some versions of ClamAV.