16.10 - Example: Secondary Element Processing—Address Range Exception - Teradata Database

Teradata Database Security Administration

Teradata Database
June 2017

The secondary element can also specify an exception for a range of IP addresses that are contained within the larger range defined by the primary element.

  • Instead of a single IP address exception, you can deny access to IP addresses for several computers in the company, for example, work stations through, with the following deny element:
    <deny ip=“

    The deny element is equivalent to the following binary number:


    The 255 in the final segment of the deny IP is optional. You can use any number between 192 and 255 to give the same results, based on the mask construction shown in the following bullet.

  • The following mask forces the filter to deny access to all workstations with IP addresses from through”/>

    This mask format indicates that only the last two bits of the fourth segment are significant. If you AND the binary values for the deny IP and the mask, the result shows why you can specify such a wide range of addresses in the forth segment of the deny IP.

    Deny IP  10001101.11001110.00100011.11111111
    Mask     11111111.11111111.11111111.11000000
    Result    10001101.11001110.00100011.11000000

    The mask is equivalent to /26”>, and indicates that the first 26 bits (the bold characters in the result) of the incoming IP address must match the masked deny IP to access to deny the incoming IP address. All IP addresses from through match the bold characters. IP addresses from through have a value of zero for either bit 25 or 26 (or both), do not match all 26 significant binary values, and therefore are not denied.

    The restriction process applies the range of the secondary element, whether it is an allow or a deny, to the binary string from left to right, that is, high to low address. The further to the left you extend the zeros in the mask, the more restrictive the secondary deny. For example, a partial mask of the third segment significantly increases the range addresses affected.