Wanguard 6.2 User Guide
Configuration » General Settings » Custom Decoders
Configuration » General Settings » Custom Decoders
Decoders
represent internal functions that differentiate and classify the underlying protocols of each packet
and flow. The predefined decoders are listed in the “Graphs & Storage” chapter on page 20. If you do not need to
define custom decoders, you may safely skip this section.
To manage user-defined decoders go to Configuration » General Settings » Custom Decoders. Each custom
decoder contains the following information:
●
Decoder Name
– A short name to help you identify the decoder. The field is mandatory.
●
Graph Color
– The color used in graphs for the decoder. The default color is a random one, which can be
changed by entering a different HTML color code or by clicking the drop-down menu.
●
Decoder Description
– An optional short description of the decoder.
●
Packet Filtering Expression
– Enter a BPF filtering expression for packets if you intend to use a Packet
Sensor and/or Packet Filter. Click the light bulb icon on the right to open a window that shows you the
correct syntax. Examples:
◦
To match TCP packets with the SYN flag set, enter
tcp[tcpflags] & tcp-syn!=0
◦
To match UDP packets with the destination port under 1024, enter
udp and dst portrange 1-1023
●
Flow Filtering Expression
– Enter a filtering expression for flows if you intend to use a Flow Sensor
and/or Flow Filter. Click the light bulb icon on the right to open a window that shows you the correct
syntax. Examples:
◦
To match TCP flows having only the SYN flag set, enter
flags S and not flags AFRPU
◦
To match flows with the MPLS label0 set to 2, enter
mpls label0=2
●
FlowSpec Expression
– Enter a FlowSpec expression if you intend to use BGP Flowspec for traffic
redirection or DDoS mitigation. Click the light bulb icon on the right to open a window that shows you
the correct syntax.
●
Included Decoders
– Required if you plan to use the decoder for IP graphing. Select the decoders that
include the matched traffic, or choose TOTAL if not sure.
●
Conflicting Decoders
– Required if you plan to use the decoder for IP graphing. Select the decoders that
might match same traffic, but not always. The option is used only for displaying stacked decoders inside
IP graphs.
●
Most-specific Filter Engine
– If you intend to use a Filter for anomalies detected using the decoder,
select the most specific Filter engine that could analyze the traffic. Otherwise, select
disabled
.
●
Netfilter Expression
– Enter Netfilter/iptables argument(s) that match the same traffic also matched by
the decoder to prevent irrelevant packets from passing the software firewall.
- 24 -
Summary of Contents for wanguard 6.2
Page 1: ......
