IP traffic patterns

The information that is gathered from an IP packet can be used to identify a specific type of network traffic, based on common Internet protocols. For example:

• Web traffic to a server consists of TCP packets inbound to and outbound from port 80.
• TN3270E Telnet server traffic consists of TCP packets inbound to and outbound from port 23.
• IKE traffic consists of UDP packets inbound from and outbound to port 500. In addition, if NAT traversal is enabled, IKE traffic can use UDP port 4500.
• Ping (IPv4) consists of ICMP packets outbound with type 8, code 0 (echo request), and inbound with type 0, code 0, (echo reply).
• Ping (IPv6) consists of ICMPv6 packets outbound with type 128, code 0 (echo request), and inbound with type 129, code 0, (echo reply).

The IpService statement groups these attributes into definitions of common traffic patterns that can subsequently be incorporated in an IP filter rule. The sample configuration file /usr/lpp/tcpip/samples/pagent_CommonIPSec.conf provides definitions for many of the common traffic patterns that are seen on a typical z/OS® server.

For more details about the IpService statement, see z/OS Communications Server: IP Configuration Reference.