background image
Filtering IPX Traffic and SAPs 487
access-list 910 actually checks for packets sourced from networks 1000 to 100F. The network
number is eight hex digits long; the leading 0s are not shown. For the network wildcard mask,
all digits are shown in the book, but the leading zeroes are omitted in an actual router
configuration. The mask 0000000F means that the first seven hex digits must match 0000100,
which are the first seven hex digits of the network number in this case, with leading 0s shown.
The last hex digit can be any value. Therefore, networks 1000, 1001, and 14 others are matched.
To exactly match the two networks 1000 and 1001, the mask 00000001 could be used. This
mask implies that all bits are checked except the one low-order bit. (Feel free to convert hex
1000 and 1001 to binary to see that only the last bit is different in the two numbers.)
SAP Filters
The key to understanding SAP filters is to understand where SAP packets flow and where they
do not. This process is fundamental to the job function of a typical CCNA. The SAP process is
very similar to routing updates with a distance vector routing protocol. In fact, SAP uses a split
horizon concept as well. The following sequence outlines a day in the life of a SAP packet:
Step 1
A router or server decides it is time to send a SAP broadcast on its
attached network, based on the expiration of its SAP timer.
Step 2
That router or server creates enough SAP packets to advertise all
its SAP information (up to seven services per packet, by default).
Step 3
That router or server sends the SAP packets out into the attached
network.
Step 4
Other routers and servers are attached to the same medium; these
routers and servers receive all the SAP packets.
Step 5
The receiving routers and servers examine the information inside
the SAP packets and update their SAP tables as necessary.
Step 6
The receiving routers and servers discard the SAP packets.
Step 7
Every server and router uses a SAP timer, which is not
synchronized with the other servers and routers. When the timer
expires, each server and router performs Steps 1 through 3, and
their neighboring servers and routers react and perform Steps 4
through 6.
In other words, the SAP packets are never forwarded by a router or server. This process is
effectively the same process used by distance vector routing protocols. So, packet filters filter
packets going through a router. Therefore, the IOS uses distribute lists (instead of packet filters)
to filter routing information. Likewise, IOS uses SAP filters to filter SAP information.
ch07.fm Page 487 Monday, March 20, 2000 5:14 PM