Ingress filter

Web interface

The filter page allows setting a processing filter for live traffic. The traffic may be filtered before it is processed. Filters can be applied for

• IP addresses (with possible subnet mask)
• pairs of IP addresses (with possible subnet mask)
• MAC addresses
• VLAN tags (or none for no VLAN tag)
• certain TCP/UDP ports
• physical interface IDs (as listed in Interface statistics)

They all can be set to either blacklist or whitelist mode. Filtering will be evaluated for every packet in the order of the tabs. The more restrictive filter will be applied. For instance, if no IP address is denied but a certain MAC address is on the blacklist, no traffic for that MAC address is being processed. The processing filter is applied on live traffic only. When replaying a PCAP or using the remote traffic capture feature, the filtering is not used.

IP filters

The IP filter page allows importing an IP list in the format:

#A line with a comment
1.2.3.1
1.2.3.2
1.2.3.3

By clicking on Import list a dialog will be openend where you can choose to download such a list from a given URL or specify a file from your system. The IPs are added to the already existing ones up to a maximum of 10000 IP addresses. The Export list button allows for exporting the IP filter list in the same format as the import. The Delete all button allows for deleting all IPs from the filter list.