IPX SAP Filtering

dingdongboomNetworking and Communications

Oct 27, 2013 (4 years and 8 months ago)



IPX SAP Filtering

Improving your network health

Ken Sallot




Understand what a SAP is

Why can SAPs be good?

Why can SAPs be bad?

Viewing your SAP table

Determining what SAP types to filter

Being a good neighbor

Requesting SAP filters


SAP is:

A “Service Advertising Protocol” for
IPX/SPX networks

Used to advertise devices or services
such as network printers, power
management systems, and file servers

Broadcast by default every 60 seconds
on an IPX network in the form of a SAP


SAP is:

Each SAP contains information about
the SAP, the type of service, the name
of the service, and IPX address for the

A SAP table consists of all devices that
broadcast SAP on the network. Every
router that routes IPX/SPX maintains a
SAP table of all devices it sees.


SAP is:

It takes 7 SAP entries to form one SAP

A SAP packet is 512 bytes in size

208K of SAP data is broadcast every 60
seconds on ALL IPX/SPX Networks to
support a SAP table with 2900 entries

There are currently over 2900 SAPs
broadcasting on the UF Network


Why are SAPs good?

Provide “Plug and Play” for IPX devices

Allow clients to find services

Can be useful in monitoring network


Why are SAPs bad?

Every router that routes IPX/SPX must
maintain a SAP table

Since every Netware 3.x/4.x server is
also a router (even if it is just between
the servers “internal network” and the
outside world), each and every Netware
3.x/4.x server must also maintain a SAP


Why are SAPs bad?

SAP broadcasts are chatty. They
consume bandwidth on IPX/SPX
networks for services that may only be
used by one or two clients. Our current
SAP table would consume the entire
bandwidth of a 28.8K modem
connection and more then 50% of the
bandwidth of a 56K WAN link


Why are SAPs bad?

As SAP tables get larger Netware
servers must have more horsepower

Large SAP tables have been known to
cause low powered (less then Pentium
100) Netware servers to exhibit strange

Some routers have a limit in how many
SAP entries they can hold in a table


Why are SAPs bad?

If there are more SAP entries then a
router can hold in its SAP table, some
devices may get “clipped” and a
situation where devices “appear and
disappear” from the network might

For many services there is no need for
SAP broadcasts


Why are SAPs bad?

Services such as Remote Console and
HP Jetdirect Administration can be done
directly just by knowing the devices IPX
network address; there is no need for
these SAP types

Quite often software developers fail to
register their SAP types with Novell,
making identification based on SAP type


Viewing your SAP table

You can use the utility IPXCON from a
Netware 4.x (or 3.x with MPR) server

From the console prompt type LOAD

Select “Services”

Use PgUp/PgDn to scroll through the


Viewing your SAP table

You can use the utility LISTOBJ which
comes with JRB Utilities

The command line “LISTOBJ *
/A/C/3/J/L=SAPS.TXT” will create a file
(SAPS.TXT) with all of the SAP entries
seen on your network


Determining SAP types to filter

Two methods of SAP filtering; The
“Indiana” Approach, The “Biggest
Culprits” Approach

The Indiana Approach is based on the
idea of filtering all SAP broadcasts
except certain “allowed types”

Indiana University has a shared IPX
network over 8 locations


Indiana Approach

They had over 300 file servers on their
IPX network

They reached a “critical mass” when
their SAP tables exceeded 3000 entries

Their central computing department
established reasonable guidelines based
on how to determine if a type of SAP
should be filtered or not


Indiana Approach Guidelines

Try to keep the rules the same
everywhere; filtering is done based on
SAP types rather than an individual SAP

Likely SAP types to filter fell under the
following criteria:

It is less then a year old

There were very few of them

Could not identify the SAP type


Indiana Approach Guidelines

If there’s an acceptable workaround for
the SAP type (example RCONSOLE
allows for specifying the server IPX

Indiana finally came up with a list of
SAP types they would allow which
eliminated over 70% of the SAP entries
broadcast on their network


Indiana University

Indiana allows the following SAP types:

0004 File Server

0047 Advertising Print Server

01D8 Castelle Fax

0152 Irmalan Gateway

026B Netware 4.x timesync server

0278 Netware directory server


Indiana University

Indiana also allows the following SAP
types until they decide if they can live
without them:

023F TSA service for Novell Backup

0355 Backup Exec

07A9 Backup Exec Job Service

044C Arcserve 5.01

03C4 Arcserve 4.0


Indiana University

They filter all other SAP types. They will
periodically remove the filter on SAP
type 030C (HP JetDirect devices) to
allow administration of these products,
however with the new version of HP
JetAdmin this is unnecessary.


Biggest Culprits Approach

Takes the approach of using the least
amount of SAP filters that will provide
the biggest amount of impact

Determine the SAP types that make up
the largest percentage of SAPs that you
see and filter the ones that will not
impact you


Biggest Culprits Approach

At UF the top 5 SAP types are:

030C HP JetDirect boards 35% of the SAPs
we see

0004 Netware 3.x/4.x Servers (9%)

0640 Windows NT IPX file sharing (7%)

0107 Netware Remote Console (7%)

8002 Intel Netport (7%)


Biggest Culprits Approach

HP JetDirect boards:

With the latest version of HP JetAdmin
software (version 3.0) you do not need to
see the SAP broadcasts to administer them

Are good candidates for filtering

Netware 3.x/4.x server:

If you can not see them you will not be
able to use the service

Are poor candidates for filtering


Biggest Culprits Approach

Windows NT IPX File Sharing:

With the use of NDS for NT this SAP type
could be filtered

Filtering would not affect small workgroups
that are using NT file sharing on the same
IPX network

Without knowing how many people use NT
IPX file sharing across campus, filtering
this SAP type is not a good idea at this


Biggest Culprits Approach

Netware Remote Console

The Remote Console client allows you to
specify the servers IPX address bypassing
the need to see the SAP

The command line is RCONSOLE

Is a great candidate for SAP filtering


Biggest Culprits Approach

Intel Netport

The client must be able to see the SAP
type to configure it

After the device has been configured the
SAP could be filtered

Filtering would require Netport
administrators to either be mobile, or
disable filters periodically for administration


Biggest Culprits Approach

With the campus wide UF SAP table
rapidly approaching 3000 SAP entries,
(I predict 3500 by October), installing
only four filters (SAP types 030C, 0640,
0107, 8002) will cut down your SAP
traffic by 56%!

CIRCA has been filtering SAP types
030C, 0107 and 8002 since March with
great success!


Being a good neighbor

Departments should consider filtering
their outgoing SAP types to help reduce
campus IPX SAP traffic

If all of your users are on the same IPX
network there is no reason for the
majority of your IPX SAP broadcasts to
be sent across the whole campus


Being a good neighbor

Some “administrative” SAP types (such
as 0107) should be filtered regardless
of where your users reside

Remember, you are responsible for the
SAPs you broadcast

If you are not actively filtering your
outgoing SAP types you have no room
to complain about large SAP tables


Requesting SAP filters

If you share your IPX subnet with other
departments make sure you clear it
with them before you request incoming
IPX SAP filters

Take your time to plan your SAP filters
correctly. Remember, once the filter is
in place you will no longer be able to
see the service


Requesting SAP filters

When choosing the outbound SAP types
to filter from your network remember
do not filter the following SAP types:

0004 Netware server

0278 Novell Directory server

026B Timesync server

Remember when your outbound filter is
up, your service is unavailable to people
outside of your IPX network


Requesting SAP filters

Make sure that you also request
outbound SAP filters from your IPX
network. If everyone on the campus
IPX network filtered their outbound
SAPs there would be no need for
inbound SAP filters

Install only one or two SAP filters at a
time to help diagnose anything that
goes awry


Requesting SAP filters

People on the UF Network requiring
filters be installed by UF Networking,
contact Dan or Bruce at 392

People on the Healthnet Network
requiring SAP filters be installed by
Healthnet should contact Randy Martin
at 395
7979. Note: Because much of
Healthnet is shared within different
groups, filters may be impractical there.


More information

I wrote an essay titled “The Case for
SAP Filtering” which can be read at:


On ftp.novell.com in the directory
14 there is
DSAP1B.EXE. This self extracting file
contains SERVER.LST, which is a list of
all public IPX/SAP server types