FPM uses a TCDF to define policies that can block attacks on the network. FPM is a packet classification feature that allows users to define one or more classes of network traffic by pairing a rich set of standard matching operators with user-defined protocol header fields. FPM users can create their own stateless packet classification criteria and define policies with multiple actions (such as drop, log, or send Internet Control Message Protocol [ICMP] unreachable) to immediately block new viruses, worms, and attacks on the network.

Before the release of the Flexible Packet Matching XML Configuration feature, FPM defined traffic classes (class maps), policies (policy maps), and service policies (attach policy maps to a class maps) through the use of CLI commands. With TCDFs, FPM can use XML as an alternative to the CLI to define classes of traffic and specify actions to apply to the traffic classes. Traffic classification behavior is the same whether you create the behavior using a TCDF or configure it using CLI commands. Once a TCDF is created, it can be loaded on any FPM-enabled device in the network.

TCDFs require that a relevant PHDF is already loaded on the device. A PHDF defines each field contained in the header of a particular protocol. Each field is described with a name, optional comment, an offset (the location of the protocol header field in relation to the start of the protocol header), and the length of the field. The total length is specified at the end of each PHDF.

The description of a traffic class in a TCDF file can contain header fields defined in a PHDF. If the PHDF is loaded on the router, the class specification to match begins with a list of the protocol headers in the packet. In the TCDF, the traffic class is associated with a policy that binds the match to an action, such as drop, log, or send ICMP unreachable.

FPM provides ready-made definitions for these standard protocols, which can be loaded onto the router with the load protocol command: ether.phdf, ip.phdf, tcp.phdf, and udp.phdf. You can also write your own custom PHDFs using XML if one is required for the TCDF.

Note	Because PHDFs are defined via XML, they are not shown in a running configuration.

In the TCDF, you can define one or more classes of traffic and policies that describe specified actions for each class of traffic. The TCDF is an XML file that you create in a text file or with an XML editor. The file that you create must have a filename that has the .tcdf extension.

The TCDF has the following basic format. XML tags are shown in bold text for example purposes only.

<tdcf
>
       <class
 ...> ... </class
>
         ...
       <policy
> ... </policy
>
         ...
</tdcf
>

For a traffic class, you can identify a match for any field or fields against any part of the packet.

Note	FPM is stateless and cannot be used to mitigate an attack that requires stateful classification, that is classify across IP fragments, across packets in a TCP stream, or peer-to-peer protocol elements.

Policies can be anything from access control, quality of service (QoS), or even routing decisions. For FPM, the associated actions (policies) might include permit, drop, log, or send ICMP unreachable.

Once loaded, the TCDF-defined classes and policies can be applied to any interface or subinterface and behave in an identical manner as the CLI-defined classes and policies. You can define policies in the TCDF and apply then to any entry point to the network to block new attacks.

A class can be any traffic stream of interest. You define a traffic stream of interest by matching a particular interface or port, a source address or destination IP address, a protocol or an application. The following sections contain information you should understand before you define the traffic class in the TCDF for FPM configuration:

• Class Element Attributes for a Traffic Classification Definition File
  
• Match Element for a Traffic Classification Definition File
  
• Operator Element Attributes for a Traffic Classification Definition File
  

A policy is any action that you apply to a class. You should understand the following information before defining the policy in a TCDF for the FPM XML configuration:

• Policy Element Attributes for a Traffic Classification Definition File
  
• Action Element for a Traffic Classification Definition File
  
• Traffic Classification Definition File Syntax Guidelines
  

1.    Open a text file or an XML editor and begin the file with the XML version and encoding declaration.

2.    Identify the file as a TCDF. For example:

3.    Define the traffic class of interest.

4.    Identify matching criteria for the defined classes of traffic. For example:

5.    Define the action to apply to the defined class. For example:

6.    End the traffic classification definition. For example:

7.    Save the TCDF file with a filename that has a .tcdf extension, for example: slammer.tcdf.

1.    enable

2.    show protocol phdf protocol-name

3.    configure terminal

4.    load protocol location:filename

5.    load classification location : filename

6.    end

7.    show class-map [type {stack | access-control}] [class-map-name]

Router# show class-map
.
.
.
class-map type stack match-all ip-udp
   match field IP protocol eq 0x11 next UDP
class-map type access-control match-all slammer 
   match field UDP dest-port eq 0x59A 
   match field IP length eq 0x194 
   match start l3-start offset 224 size 4 eq 0x4011010 
.
.
.

• What to Do Next
  

1.    enable

2.    configure terminal

3.    interface type slot / port

4.    service-policy type access-control ] {input | output} policy-map-name

5.    end

6.    show policy-map interface type access-control ] interface-name slot/port[input | output]

1.    enable

2.    show class-map [ type { stack | access-control}] [class-map-name]

3.    show class-map type stack [class-map name]

4.    show class-map type access-control [class-map-name]

5.    show policy-map [policy-map]

6.    exit