Ingress filter

Web interface

The filter page allows setting a processing filter for live traffic. The traffic may be filtered before it is processed. Filters can be applied for:

• IP addresses (with possible subnet mask).
• pairs of IP addresses (with possible subnet mask).
• MAC addresses.
• VLAN tags (or none for no VLAN tag).
• specific TCP/UDP ports.
• physical interface IDs (as listed in Interface statistics).

They can all be set to either blacklist or whitelist mode. Filtering will be evaluated for every packet in tab order. The more restrictive filter will be applied. For instance; if no IP address is denied but a specific MAC address is on the blacklist, no traffic for that MAC address will be processed. The processing filter is applied on live traffic only. When replaying a pcap or using the remote traffic capture feature, filtering is not used.

IP filters

The IP filter page allows importing an IP list in the format:

#A line with a comment
1.2.3.1
1.2.3.2
1.2.3.3

By clicking on Import list a dialogue box will be opened where you can choose to download such a list from a given URL or specify a file from your system. The IP addresses are added to the existing ones up to a maximum of 10000 addresses.

The Export list button allows for exporting the IP filter list in the same format as the import.

The Delete all button allows for deleting all IP addresses from the filter list.