EthSwt has its own stream concept, not covered in the core series: every received Ethernet frame can be matched against configured filter rules of an EthSwtStreamIdentificationEntry — the basis for TSN use cases and this series' firewall interaction post.

Filter rules are AND-linked

An EthSwtStreamFilterRule can contain multiple filter rule primitives — e.g. EthSwtStreamFilterMACSrcAddress and EthSwtStreamFilterVlanId. The SWS is explicit here:

If multiple filter rule primitives are configured, they’re considered AND-linked. A frame only qualifies as a "matching stream" if all configured primitives match simultaneously — if only the source MAC address matches but not the VLAN ID, the frame does not count as a match.

EthSwtStreamIdentificationEntry
 └── EthSwtStreamFilterRule
      ├── EthSwtStreamFilterMACSrcAddress     (primitive 1)
      ├── EthSwtStreamFilterVlanId            (primitive 2)
      └── ... further primitives             (each AND-linked)

Wildcard primitives

If a primitive is not configured within an existing EthSwtStreamFilterRule, per the SWS it’s automatically treated as matching (a "wildcard filter rule primitive"). A completely empty EthSwtStreamFilterRule — with no primitives configured at all — therefore matches every frame whose internal frame route matches the corresponding EthSwtStreamIdentificationEntry.

That makes an empty filter rule a useful "catch-all" tool — e.g. for collecting statistics on an entire stream route without having to explicitly configure every single filter criterion.

Filter actions: what happens on a match?

An EthSwtStreamFilterAction describes what happens to a frame that qualifies as a "matching stream":

ActionBehavior

EthSwtStreamFilterActionDropFrame

The frame is dropped

EthSwtStreamFilterActionBlockSource

This frame and all subsequent frames with the same source MAC address are blocked

EthSwtStreamFilterActionVlanModification

The frame’s VLAN ID is changed to the configured value

EthSwtStreamFilterActionDestinationPortModification

The frame’s egress destination is modified (see below)

Egress redirection: overwrite, extend, limit

For EthSwtStreamFilterActionDestinationPortModification, EthSwtStreamFilterActionDestinationPortModificationType determines how the original egress destination (one or more ports) is modified:

TypeMeaning

ETHSWT_STREAM_EGRESS_DESTINATION_OVERWRITE

The egress destination is completely replaced by the configured ports

ETHSWT_STREAM_EGRESS_DESTINATION_EXTEND

The configured ports are added to the original egress destination

ETHSWT_STREAM_EGRESS_DESTINATION_LIMIT

The configured ports are added, but limited to the ports where the frame would actually be allowed per the egress port state (e.g. VLAN membership, assigned MAC address)

Per the SWS, the practical use case for LIMIT is to specifically restrict a packet’s egress ports — e.g. to guarantee that a stream never leaves a port it isn’t actually permitted to use per the VLAN configuration, even under an extending configuration.

Per spec, each EthSwtStreamFilterActionDestinationPortModification may reference a given EthSwtPortEgress exclusively exactly once — multiple references to the same egress port within the same action are not allowed.

Statistics and firewall integration

EthSwt_ExtractStreamHandleIdx and EthSwt_GetStreamHandleIdxStatistics provide statistics on the configured streams — details on this and the integration with the Firewall module are in this series' dedicated firewall interaction post.

Practical example: a TSN stream route

  1. Create an EthSwtStreamIdentificationEntry with filter rule EthSwtStreamFilterMACSrcAddress = <camera MAC> and EthSwtStreamFilterVlanId = 20

  2. Configure a filter action EthSwtStreamFilterActionDestinationPortModification with type EXTEND to additionally mirror the stream to a diagnostic port

  3. Poll EthSwt_GetStreamHandleIdxStatistics cyclically to monitor the stream’s transmission rate

Summary

AspectKey takeaway

Filter rules

Multiple primitives are AND-linked; unconfigured primitives act as wildcards

Filter actions

Drop, block-source, VLAN modification, egress redirection

Egress redirection

Three types: overwrite, extend, limit — with LIMIT acting as a security mechanism against disallowed egress ports

See also

This series' firewall interaction post for statistics and security events