SNIP_ADAPTIVE_IDSM_FIGURE_Figure_7_3

Figure 7.3: SEV protocol matching process The incoming network packet matches none of the defined rules, so the default action applies here. The network packet matches the Ipv4Rule and TcpRule for rule number 1 and 2, only Ipv4Rule for rule number 3 and only SomeipProtocolRule for rule number 5. Rule 1 and 2 have the most succeeding matching ISO OSI Layers starting from the lowest network layer (in contrast to Rule 5, for example, that has a match on SOME/IP layer but no matches on lower layers.). The rule mismatch is hence occurring on the SOME/IP layer and a SEv shall be raised for this protocol. [AP_SWS_Fw_60005] ⌈If a network packet is blocked by the default action and the network protocol that was not matching the FirewallRules is Ethernet, the FC Firewall shall raise the SEv SEV_FW_P ACKET_BLOCKED_DA T ALINKLA YER_MISMA TCH to theIdsM.⌋(FO_RS_Fw_00008) [AP_SWS_Fw_60006]⌈If a network packet is blocked by the default action and the network protocol that was not matching the FirewallRules is IPv4, the FC Firewall shall raise the SEv SEV_FW_P ACKET_BLOCKED_IPV4_MISMA TCH to the IdsM.⌋ (FO_RS_Fw_00008) [AP_SWS_Fw_60007]⌈If a network packet is blocked by the default action and the network protocol that was not matching the FirewallRules is IPv6, the FC Firewall shall raise the SEv SEV_FW_P ACKET_BLOCKED_IPV6_MISMA TCH to the IdsM.⌋ (FO_RS_Fw_00008) [AP_SWS_Fw_60008]⌈If a network packet is blocked by the default action and the network protocol that was not matching the FirewallRules is ICMP , the FC Firewall shall raise the SEv SEV_FW_P ACKET_BLOCKED_ICMP_MISMA TCH to the IdsM.⌋(FO_RS_Fw_00008) [AP_SWS_Fw_60009]⌈If a network packet is blocked by the default action and the network protocol that was not matching the FirewallRules is TCP , the FC Firewall shall raise the SEv SEV_FW_P ACKET_BLOCKED_TCP_MISMA TCH to the IdsM.⌋ (FO_RS_Fw_00008)