filters.html

一个网络流量分析的完整的程序

VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>sunsite.unc.edu</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>cebu.mozcom.com</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  To omit display of traffic to/from 140.66.5.x from/to anywhere</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1479"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP Address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>140.66.5.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><P
>  In all the above examples, you could have interchanged the first and
  second sets of IP addresses, wildcard masks, and port values; they
  wouldn't have made any difference. That's why they're better referred to
  as "first" and "second" rather than "source" and "target".</P
><P
>  You can enter as many parameters as you wish. All of them will
  be interpreted when the filter is processed.</P
></DIV
><DIV
CLASS="SECT3"
><H3
CLASS="SECT3"
><A
NAME="AEN1509"
>Excluding Certain Sites</A
></H3
><P
>&#13;  Filters follow an "implicit no-display" policy, that is, only explicitly
  defined sites will be displayed, everything else is not. This is similar
  to the access-list policy "whatever is not explicitly permitted is
  denied". If you want to show all traffic to/from everywhere,
  except certain places, you can specify the sites you wish to exclude,
  mark them with <TT
CLASS="COMPUTEROUTPUT"
>E</TT
> in the <TT
CLASS="COMPUTEROUTPUT"
>Include/Exclude
field</TT
>, and
  define a general catch-all entry with source address
<TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>, mask
  <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>, port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>, and destination
<TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>, mask <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>,
port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>, tagged
  with an <TT
CLASS="COMPUTEROUTPUT"
>I</TT
>
in the <TT
CLASS="COMPUTEROUTPUT"
>Include/Exclude</TT
> field as the last entry.</P
><P
>  For example:</P
><P
>To see all traffic except all SMTP, Web, and traffic from/to 207.0.115.44</P
><DIV
CLASS="INFORMALTABLE"
><A
NAME="AEN1524"
></A
><P
></P
><TABLE
BORDER="0"
WIDTH="100%"
BGCOLOR="#E0E0E0"
CELLSPACING="0"
CELLPADDING="4"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>25</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>&nbsp;</TD
><TD
>&nbsp;</TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
> 0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>80</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>&nbsp;</TD
><TD
>&nbsp;</TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>207.0.115.44</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>255.255.255.255</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>E</TT
></TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>&nbsp;</TD
><TD
>&nbsp;</TD
><TD
>&nbsp;</TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Host name/IP address</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Wildcard mask</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Port</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>0</TT
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
>Include/Exclude</TD
><TD
WIDTH="33%"
ALIGN="LEFT"
VALIGN="TOP"
><TT
CLASS="COMPUTEROUTPUT"
>I</TT
></TD
><TD
>&nbsp;</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Tip</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  To omit all TCP from the display, define a filter with a single
  entry, with a source of <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
> mask
<TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
> port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>, and a destination
  of <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
> mask <TT
CLASS="COMPUTEROUTPUT"
>0.0.0.0</TT
>
port <TT
CLASS="COMPUTEROUTPUT"
>0</TT
>,
with the <TT
CLASS="COMPUTEROUTPUT"
>Include/Exclude</TT
> field
  marked <TT
CLASS="COMPUTEROUTPUT"
>E</TT
> (exclude). Then apply this filter.</P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1635"
>Applying a Filter</A
></H2
><P
>  The above steps only add the filter to a defined list. To actually apply
  the filter, you must select <I
CLASS="EMPHASIS"
>Apply filter...</I
> from the menu. You will be
  presented with a list of filters you already defined. Select the one you
  want to apply, and press Enter.</P
><P
>  The applied filter stays in effect over exits and restarts of the IPTraf program until it is detached.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1640"
>Editing a Defined Filter</A
></H2
><P
>  Select <I
CLASS="EMPHASIS"
>Edit filter...</I
> to modify an existing filter. Once you select this
  option, you will be presented with the list of defined filters.
  Select the filter you want to edit by moving the selection bar and press
  Enter.</P
><P
>  Edit the description if you wish. Pressing Ctrl+X at this point
  will abort the operation, and the filter will remain unmodified. Press
  Enter to accept any changes to the filter description.</P
><DIV
CLASS="FIGURE"
><A
NAME="AEN1645"
></A
><P
><IMG
SRC="iptraf-editfilter.png"></P
><P
><B
>Figure 5. The filter parameters selection screen.  Selecting an entry
displays that set for editing</B
></P
></DIV
><P
>  After pressing Enter, you will see the filter's rules. To edit an
  existing filter rule, move the selection bar
  to the desired entry and press Enter. A prefilled dialog box
  will appear. Edit its contents as desired. Press Enter to accept the
  changes or Ctrl+X to discard.</P
><P
>  You can add a new filter rule by pressing I to insert at the selection
  bar's current position. When you press I, you will be presented with a
  dialog box asking you to enter the new rule data. Pressing A results
  in a similar operation, except the rule will be appended as the
  last entry in the rule list.</P
><P
>  Pressing D deletes the currently pointed entry.</P
><P
>  Press X or Ctrl+X to end the edit and save the changes.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>If you're editing the currently applied filter, you will need
  to re-apply the filter for the changes to take effect.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="CENTER"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Be aware that the filter process the rules in order. In other
  words, if a packet matches more than one rule, only the first matching
  rule is followed.</P
></TD
></TR
></TABLE
></DIV
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1658"
>Deleting a Defined Filter</A
></H2
><P
>  Select <I
CLASS="EMPHASIS"
>Delete filter...</I
> from the menu to remove a filter
  from the list. Just move the selection bar to the filter you want to
  delete, and press Enter.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1662"
>Detaching a Filter</A
></H2
><P
>  The <I
CLASS="EMPHASIS"
>Detach filter</I
> option deactivates the filter currently in
  use. Selecting this option causes all TCP traffic to be passed
  to the monitors.</P
><P
>  When you're done with the menu, just select the Exit menu option.</P
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="morelanmoninfo.html"
>&#60;&#60;&#60; Previous</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="manual.html"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="udpfilters.html"
>Next &#62;&#62;&#62;</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Additional Information</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>UDP Filters</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>