Wanguard 6.2 User Guide
Configuration » Components » Packet Filter
parameter to a BGP Connector configured to reroute traffic. Other parameters must be set as in the
Inline filtering mode.
○
Out-of-line monitoring
– Packet Filter runs on a server that receives a copy of packets from a
network TAP or a mirroring port. Direct filtering is not possible, but Packet Filter is still able to
generate filtering rules that improve the visibility of attacks, which can be applied to other in-line
appliances or firewalls. To run the Packet Filter in this mode, set the Inbound Interface to be the
same as the Sniffing Interface configured in the Packet Sensor.
●
Filter Server
– The server that runs the Packet Filter. The configuration of servers is described on page
●
CPU Threads
– The Packet Filter can run multi-threaded on a given set of CPU cores. Each thread
increases the RAM usage. On most systems, activating more than 6 CPU threads hurts performance.
●
Sniffing Interface
– The network interface(s) listened by the Packet Filter. Entering the Inbound Interface
increases CPU usage because all traffic is inspected, even the traffic that is not forwarded. Entering the
Outbound Interface decreases CPU usage because only the forwarded traffic reaches that interface.
Packet Filter obtains malicious traffic statistics from the local firewall.
●
Capture Engine
– Select the packet capturing engine used by the Packet Filter:
○
Embedded LibPcap
– Select to use the built-in LibPcap 1.6.2 library.
○
System LibPcap
– Select to use the LibPcap library installed by the Linux distribution.
○
Myricom Sniffer10G
– Select when using a Myricom network adapter with a Sniffer 10G license.
Click the button on the right for driver-specific settings.
○
PF_RING
– Select to use the PF_RING 6.4 framework to speed up packet processing. Click the button
on the right for PF_RING-specific settings.
●
Filtering Interface
– Select where to apply filtering rules:
○
None –
Packet Filter does not apply filtering rules directly.
○
Inbound –
Packet Filter applies filtering rules on the inbound Interface.
○
Outbound –
Packet
Filter applies filtering rules on the outbound interface.
●
Traffic Diversion
– Provides a selection of BGP Connectors that may be used for traffic diversion. If the
server is deployed in-line, or if you do not plan to use traffic diversion, leave the field set to “None”.
When a BGP Connector is selected, the Packet Filter sends a BGP routing update that makes the server
next hop for the attacked IP address. When the attack ends, the Packet Filter automatically withdraws
the BGP announcement and the traffic towards the IP address is routed normally. Make sure that the
Sensor that detected the attack is still able to capture traffic rerouted to the Packet Filter.
For more information about BGP Connectors, consult the “BGP Connector” chapter on page 51.
●
Inbound Interface
– Enter the interface that receives traffic to your network. For a bridged interface,
prepend the string
physdev:
in front of the interface name.
●
Outbound Interface
– The cleaned traffic is sent to a downstream router through the outbound
interface, which should hold the route to the default gateway. For GRE / IP over IP tunneling, configure
virtual network interfaces with the
ip
command, part of the
iproute2
package. For a bridged interface,
prepend the string
physdev:
in front of the interface name.
●
Software Firewall
– Select the software firewall policy applied when the Packet Filter generates a
- 56 -
Summary of Contents for wanguard 6.2
Page 1: ......
