Intel AMT Features > System Defense > Use Cases > Create an Ethernet Filter
CollapseAll image

Create an Ethernet Filter

The following step describes how to create an Ethernet filter.

1.  Create a local instance of AMT_Hdr8021Filter with the following mandatory properties:

Property

Value

InstanceID

Enter any value (the value is overridden; enter zero to avoid problems with compatibility across versions).

Name

“EthernetFilterExample” – Enter a meaningful name that you can use later to search for this instance. Maximum length 16.

CreationClassName

Enter any value (the value is overridden)

SystemName

Enter any value (the value is overridden)

SystemCreationClassName

Enter any value (the value is overridden)

HdrProtocolID8021

Determines the filter’s Ethernet protocol. For example:

     2048 – The IP IANA number 0x800

     2054 – The ARP IANA number 0x806

FilterProfile

The type/behavior of the filter. Valid values:

     0 – Statistics + Pass

     1 – Statistics + Drop

     2 – Rate Limit

     3 – Pass

     4 – Drop

FilterDirection

The direction of the traffic to filter. Valid values:

     0 – Outgoing (Tx)

     1 – Incoming (Rx)

ActionEventOnMatch

Create an event in the Event Manager when this filter is matched. Valid values:

     True

     False

2.  Execute AMT_Hdr8021Filter.Create.

3.  Save the returned EPR. It will be used to retrieve this filter or to associate it with a policy.

Click here for a snippet demonstrating this step

You can execute this snippet by inserting it into the execution template found here.

  

$hdr8021FilterInstance =$wsmanConnectionObject.NewInstance("AMT_Hdr8021Filter")

$hdr8021FilterInstance.SetProperty("InstanceID","0")

$hdr8021FilterInstance.SetProperty("Name","MyEthernetFilter")

$hdr8021FilterInstance.SetProperty("CreationClassName","n/a")

$hdr8021FilterInstance.SetProperty("SystemName","n/a")

$hdr8021FilterInstance.SetProperty("SystemCreationClassName","n/a")

$hdr8021FilterInstance.SetProperty("HdrProtocolID8021","33024")

$hdr8021FilterInstance.SetProperty("FilterProfile","3")

$hdr8021FilterInstance.SetProperty("FilterDirection","1")

$hdr8021FilterInstance.SetProperty("ActionEventOnMatch","false")

# The $hdr8021FilterRef is an EPR to the new AMT_Hdr8021Filter object.

$hdr8021FilterRef =$hdr8021FilterInstance.Create()

 

 

 

 Note:

The filter’s protocol is determined by the HdrProtocolID8021 property which takes IANA numbers.

 

Instance Diagram

Not applicable

Classes Used in This Flow

SDK Sample

If there is a sample demonstrating this flow, it is included in the SDK installation file. See SDK Installation Layout for details.

 

See Also:

   Network Isolation

   System Defense Policies

   Heuristic Policies

   System Defense Filter Types

   Processing Network Packets with System Defense

   Networking Packet Structures

Copyright © 2006-2022, Intel Corporation. All rights reserved.