Example: Secondary Element Processing—Address Range Exception - Advanced SQL Engine - Teradata Database

The secondary element can also specify an exception for a range of IP addresses that are contained within the larger range defined by the primary element.

• Instead of a single IP address exception, you can deny access to IP addresses for several computers in the company, for example, work stations 141.206.35.192 through 141.206.35.255, with the following deny element:

  <deny ip=“141.206.35.255/

  The deny element is equivalent to the following binary number:

  10001101.11001110.00100011.11111111

  The 255 in the final segment of the deny IP is optional. You can use any number between 192 and 255 to give the same results, based on the mask construction shown in the following bullet.

• The following mask forces the filter to deny access to all workstations with IP addresses from 141.206.35.192 through 141.206.35.255:

  255.255.255.192”/>

  This mask format indicates that only the last two bits of the fourth segment are significant. If you AND the binary values for the deny IP and the mask, the result shows why you can specify such a wide range of addresses in the forth segment of the deny IP.

  Deny IP  10001101.11001110.00100011.11111111
  Mask     11111111.11111111.11111111.11000000
  ____________________________________________
  Result    10001101.11001110.00100011.11000000

  The mask is equivalent to /26”>, and indicates that the first 26 bits (the bold characters in the result) of the incoming IP address must match the masked deny IP to access to deny the incoming IP address. All IP addresses from 141.206.35.192 through 141.206.35.255 match the bold characters. IP addresses from 141.206.35.1 through 141.206.35.191 have a value of zero for either bit 25 or 26 (or both), do not match all 26 significant binary values, and therefore are not denied.

  The restriction process applies the range of the secondary element, whether it is an allow or a deny, to the binary string from left to right, that is, high to low address. The further to the left you extend the zeros in the mask, the more restrictive the secondary deny. For example, a partial mask of the third segment significantly increases the range addresses affected.