Wanguard 6.2 User Guide
Configuration » Components » Packet Sensor
●
Sensor License
– The license used by the Packet Sensor. Wanguard provides all features; WanSight does
not provide traffic anomaly detection and reaction.
●
Top Generator
– Allows generation of traffic tops:
○
Basic
– Enables tops for Internal IPs, IP protocols, versions and TCP/UDP ports. It is the
recommended value because it adds a very small performance penalty.
○
Extended
– Enables all tops from
Basic
as well as tops for External IPs (IPs not included in the IP
Zone). It adds performance penalty of over 20%, especially during spoofed attacks.
○
Full
– Enables all tops from
Extended
as well as tops and graphs for autonomous systems. It adds a
performance penalty of over 20%, especially during spoofed attacks.
●
IP Zone
– Packet Sensor needs an IP Zone from which to learn about your network's boundaries and to
extract per-subnet settings. IP Zones are described in the “IP Zone” chapter on page 34.
●
IP Validation
– This option can be used to distinguish the direction of the packets or to ignore certain
IPs:
○
Off
– Packet Sensor analyzes all traffic and uses MAC Validation to identify the direction of traffic.
○
On
– Packet Sensor analyzes the traffic that has the source and/or the destination IP in the selected
IP Zone.
○
Strict
– Packet Sensor analyzes the traffic that has either the source or the destination IP in the
selected IP Zone.
○
Exclusive
– Packet Sensor analyzes the traffic that has the destination IP in the selected IP zone, but
not the source IP.
●
MAC Validation/Address
– This option can be used to distinguish the direction of the packets or to
ignore unwanted OSI Layer 2 traffic:
○
None
– Packet Sensor analyzes all traffic and uses IP Validation to identify the direction of traffic.
○
Upstream MAC
– MAC validation is active and the MAC Address belongs to the upstream router.
○
Downstream MAC
– MAC validation is active and the MAC Address belongs to the downstream
router.
The MAC Address must be written using the Linux convention – six groups of two hexadecimal
values separated by colons (
:
).
●
BPF Expression
– You can filter the type of traffic the Packet Sensor receives using a tcpdump-style
syntax.
●
Sampling (1/N)
– Must contain the packet sampling rate. On most systems, the correct value is 1.
●
Comments
– Comments about the Packet Sensor can be saved here. They are not visible elsewhere.
To start the Packet Sensor, click the gray square button next to its name in Configuration » Components.
Ensure that the Packet Sensor starts correctly by watching the event log (details on page 69).
If the Packet Sensor starts without errors, but you can't see any data collected by it in Reports » Components
» Overview, follow the troubleshooting guide from page 41.
- 39 -
Summary of Contents for wanguard 6.2
Page 1: ......
