IP Classification Syntax

Note: IPv4 only (so far..)

You normally specify a classifier in a string:

<classifier spec> := <classifier name>"("<argument>")"

Where name:

• "AND" -> IpAndClassifier - makes an AND on the classifiers found in argument

        <argument> := <classifier spec>[","<classifier spec>]*
  

• "OR" -> IpOrlassifier - makes an OR on the classifiers found in argument

         <argument> := <classifier spec>[","<classifier spec>]*
  

• "NOT" -> IpNotClassifier - return the NOT on the classifier in argument

         <argument> := <classifier spec>
  

• "IPLOC" -> IpLocationClassifier - is in the class if we are in the location

specified in argument

      <argument> := <location spec>[","<location spec>]*
      <location spec> := "C:"<country> |
                         "CS:"<country short> |
                         "REG:"<region> |
                         "CITY:"<city> |
                         "ISP:"<isp>

• "IPFILTER" -> IpFilterStringClassifier - filters an IP that matches a

ip filter specification:

     <argument> := <filter spec>[","<filter spec>]*
     <filter spec> := <ip spec> | <ip range spec>
     <ip spec> := <uint8>"."<uint8>"."<uint8>"."<uint8>
     <ip range spec> := <uint8>"."<uint8>"."<uint8>"."<uint8>"/"<uint8>

• "IPFILTERFILE" -> IpFilterFileClassifier - same as IpFilterStringClassifier,

but the filter specifications are given in a file (one per line).

     <argument> := <filename>
     content of <filename> := <filter spec>["\n"<filter spec>]*

A specification like:

  OR(IPLOC(CITY:BUCHAREST,CITY:PLOIESTI,ISP:EVOLVA),IPFILTER(171.1.2.0/24),
     AND(IPFILTER(201.1.2.240/26), NOT(IPLOC(CITY:PITESTI))))

will make a class that has ips in:

   - city of BUCHAREST or PLOIEST and isp w/ Evolva
  OR
   - under ip mask 171.1.2.0/24
  OR
   - under ip mask 201.1.2.240/26
     AND not in PITESTI