From: k_kaloianov@eircom.net
Date: Sun Aug 22 2004 - 12:13:23 GMT-3
Hi Georg,
I was wondering the same thing myself but what I found out recently is that: When using access-lists for you have to consider that a SAP could be either command or response, which is appointed by a C/R bit in the SSAP, 0 for commands and 1 for responses, and this will be SSAP 0x5 will be response to SAP 0x4, which all are included in 0x0d0d. If you want to block everytning in NETBIOS 0xF1 and 0xF0, your wildcard mask will be 0x0101, and on the other hand if you want to block just 0xF0F0 then you could use wildcard of 0x0000. This is how I'm trying to explain it to myself, hope it makes sense?
Reg,
Kaloyan
This archive was generated by hypermail 2.1.4 : Fri Sep 03 2004 - 07:02:47 GMT-3